# All Atomic Tests by ATT&CK Tactic & Technique
# stealth
- [T1055.011 Process Injection: Extra Window Memory Injection](../../T1055.011/T1055.011.md)
  - Atomic Test #1: Process Injection via Extra Window Memory (EWM) x64 executable [windows]
- T1205.002 Socket Filters [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- T1027.011 Fileless Storage [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- [T1218.011 Signed Binary Proxy Execution: Rundll32](../../T1218.011/T1218.011.md)
  - Atomic Test #1: Rundll32 execute JavaScript Remote Payload With GetObject [windows]
  - Atomic Test #2: Rundll32 execute VBscript command [windows]
  - Atomic Test #3: Rundll32 execute VBscript command using Ordinal number [windows]
  - Atomic Test #4: Rundll32 advpack.dll Execution [windows]
  - Atomic Test #5: Rundll32 ieadvpack.dll Execution [windows]
  - Atomic Test #6: Rundll32 syssetup.dll Execution [windows]
  - Atomic Test #7: Rundll32 setupapi.dll Execution [windows]
  - Atomic Test #8: Execution of HTA and VBS Files using Rundll32 and URL.dll [windows]
  - Atomic Test #9: Launches an executable using Rundll32 and pcwutl.dll [windows]
  - Atomic Test #10: Execution of non-dll using rundll32.exe [windows]
  - Atomic Test #11: Rundll32 with Ordinal Value [windows]
  - Atomic Test #12: Rundll32 with Control_RunDLL [windows]
  - Atomic Test #13: Rundll32 with desk.cpl [windows]
  - Atomic Test #14: Running DLL with .init extension and function [windows]
  - Atomic Test #15: Rundll32 execute command via FileProtocolHandler [windows]
  - Atomic Test #16: Rundll32 execute payload by calling RouteTheCall [windows]
- T1027.009 Embedded Payloads [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- T1564.012 File/Path Exclusions [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- [T1216.001 Signed Script Proxy Execution: Pubprn](../../T1216.001/T1216.001.md)
  - Atomic Test #1: PubPrn.vbs Signed Script Bypass [windows]
- T1574.007 Path Interception by PATH Environment Variable [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- [T1006 Direct Volume Access](../../T1006/T1006.md)
  - Atomic Test #1: Read volume boot sector via DOS device path (PowerShell) [windows]
- [T1564.008 Hide Artifacts: Email Hiding Rules](../../T1564.008/T1564.008.md)
  - Atomic Test #1: New-Inbox Rule to Hide E-mail in M365 [office-365]
- [T1027.013 Obfuscated Files or Information: Encrypted/Encoded File](../../T1027.013/T1027.013.md)
  - Atomic Test #1: Decode Eicar File and Write to File [windows, macos, linux]
  - Atomic Test #2: Decrypt Eicar File and Write to File [windows, macos, linux]
  - Atomic Test #3: Password-Protected ZIP Payload Extraction and Execution [linux, macos]
- [T1014 Rootkit](../../T1014/T1014.md)
  - Atomic Test #1: Loadable Kernel Module based Rootkit [linux]
  - Atomic Test #2: Loadable Kernel Module based Rootkit [linux]
  - Atomic Test #3: dynamic-linker based rootkit (libprocesshider) [linux]
  - Atomic Test #4: Loadable Kernel Module based Rootkit (Diamorphine) [linux]
- [T1036.007 Masquerading: Double File Extension](../../T1036.007/T1036.007.md)
  - Atomic Test #1: File Extension Masquerading [windows]
- [T1542.001 Pre-OS Boot: System Firmware](../../T1542.001/T1542.001.md)
  - Atomic Test #1: UEFI Persistence via Wpbbin.exe File Creation [windows]
- [T1574.011 Hijack Execution Flow: Services Registry Permissions Weakness](../../T1574.011/T1574.011.md)
  - Atomic Test #1: Service Registry Permissions Weakness [windows]
  - Atomic Test #2: Service ImagePath Change with reg.exe [windows]
- T1542.003 Bootkit [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- T1218.013 Mavinject [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- [T1036.005 Masquerading: Match Legitimate Name or Location](../../T1036.005/T1036.005.md)
  - Atomic Test #1: Execute a process from a directory masquerading as the current parent directory [macos, linux]
  - Atomic Test #2: Masquerade as a built-in system executable [windows]
  - Atomic Test #3: Masquerading cmd.exe as VEDetector.exe [windows]
- T1036.008 Masquerade File Type [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- [T1564 Hide Artifacts](../../T1564/T1564.md)
  - Atomic Test #1: Extract binary files via VBA [windows]
  - Atomic Test #2: Create a Hidden User Called "$" [windows]
  - Atomic Test #3: Create an "Administrator " user (with a space on the end) [windows]
  - Atomic Test #4: Create and Hide a Service with sc.exe [windows]
  - Atomic Test #5: Command Execution with NirCmd [windows]
- T1542.005 TFTP Boot [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- [T1497.001 Virtualization/Sandbox Evasion: System Checks](../../T1497.001/T1497.001.md)
  - Atomic Test #1: Detect Virtualization Environment (Linux) [linux]
  - Atomic Test #2: Detect Virtualization Environment (FreeBSD) [linux]
  - Atomic Test #3: Detect Virtualization Environment (Windows) [windows]
  - Atomic Test #4: Detect Virtualization Environment via ioreg [macos]
  - Atomic Test #5: Detect Virtualization Environment via WMI Manufacturer/Model Listing (Windows) [windows]
  - Atomic Test #6: Detect Virtualization Environment using sysctl (hw.model) [macos]
  - Atomic Test #7: Check if System Integrity Protection is enabled [macos]
  - Atomic Test #8: Detect Virtualization Environment using system_profiler [macos]
- [T1218.004 Signed Binary Proxy Execution: InstallUtil](../../T1218.004/T1218.004.md)
  - Atomic Test #1: CheckIfInstallable method call [windows]
  - Atomic Test #2: InstallHelper method call [windows]
  - Atomic Test #3: InstallUtil class constructor method call [windows]
  - Atomic Test #4: InstallUtil Install method call [windows]
  - Atomic Test #5: InstallUtil Uninstall method call - /U variant [windows]
  - Atomic Test #6: InstallUtil Uninstall method call - '/installtype=notransaction /action=uninstall' variant [windows]
  - Atomic Test #7: InstallUtil HelpText method call [windows]
  - Atomic Test #8: InstallUtil evasive invocation [windows]
- T1027.008 Stripped Payloads [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- [T1574.001 Hijack Execution Flow: DLL](../../T1574.001/T1574.001.md)
  - Atomic Test #1: DLL Search Order Hijacking - amsi.dll [windows]
  - Atomic Test #2: Phantom Dll Hijacking - WinAppXRT.dll [windows]
  - Atomic Test #3: Phantom Dll Hijacking - ualapi.dll [windows]
  - Atomic Test #4: DLL Side-Loading using the Notepad++ GUP.exe binary [windows]
  - Atomic Test #5: DLL Side-Loading using the dotnet startup hook environment variable [windows]
  - Atomic Test #6: DLL Search Order Hijacking,DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE [windows]
- T1036.009 Break Process Trees [CONT