Skip to content

Commit

Permalink
Generated docs from job=generate-docs branch=master [ci skip]
Browse files Browse the repository at this point in the history
  • Loading branch information
Atomic Red Team doc generator committed Nov 8, 2023
1 parent 717f594 commit da6a051
Show file tree
Hide file tree
Showing 9 changed files with 457 additions and 2 deletions.
2 changes: 1 addition & 1 deletion atomics/Indexes/Attack-Navigator-Layers/art-navigator-layer-windows.json
View file

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion atomics/Indexes/Attack-Navigator-Layers/art-navigator-layer.json
View file

Large diffs are not rendered by default.

3 changes: 3 additions & 0 deletions atomics/Indexes/Indexes-CSV/index.csv
View file
Original file line number Diff line number Diff line change
Expand Up @@ -582,6 +582,7 @@ privilege-escalation,T1053.005,Scheduled Task/Job: Scheduled Task,6,WMI Invoke-C
privilege-escalation,T1053.005,Scheduled Task/Job: Scheduled Task,7,Scheduled Task Executing Base64 Encoded Commands From Registry,e895677d-4f06-49ab-91b6-ae3742d0a2ba,command_prompt
privilege-escalation,T1053.005,Scheduled Task/Job: Scheduled Task,8,Import XML Schedule Task with Hidden Attribute,cd925593-fbb4-486d-8def-16cbdf944bf4,powershell
privilege-escalation,T1053.005,Scheduled Task/Job: Scheduled Task,9,PowerShell Modify A Scheduled Task,dda6fc7b-c9a6-4c18-b98d-95ec6542af6d,powershell
privilege-escalation,T1053.005,Scheduled Task/Job: Scheduled Task,10,"Scheduled Task (""Ghost Task"") via Registry Key Manipulation",704333ca-cc12-4bcf-9916-101844881f54,command_prompt
privilege-escalation,T1546.013,Event Triggered Execution: PowerShell Profile,1,Append malicious start-process cmdlet,090e5aa5-32b6-473b-a49b-21e843a56896,powershell
privilege-escalation,T1053.007,Kubernetes Cronjob,1,ListCronjobs,ddfb0bc1-3c3f-47e9-a298-550ecfefacbd,bash
privilege-escalation,T1053.007,Kubernetes Cronjob,2,CreateCronjob,f2fa019e-fb2a-4d28-9dc6-fd1a9b7f68c3,bash
Expand Down Expand Up @@ -829,6 +830,7 @@ execution,T1053.005,Scheduled Task/Job: Scheduled Task,6,WMI Invoke-CimMethod Sc
execution,T1053.005,Scheduled Task/Job: Scheduled Task,7,Scheduled Task Executing Base64 Encoded Commands From Registry,e895677d-4f06-49ab-91b6-ae3742d0a2ba,command_prompt
execution,T1053.005,Scheduled Task/Job: Scheduled Task,8,Import XML Schedule Task with Hidden Attribute,cd925593-fbb4-486d-8def-16cbdf944bf4,powershell
execution,T1053.005,Scheduled Task/Job: Scheduled Task,9,PowerShell Modify A Scheduled Task,dda6fc7b-c9a6-4c18-b98d-95ec6542af6d,powershell
execution,T1053.005,Scheduled Task/Job: Scheduled Task,10,"Scheduled Task (""Ghost Task"") via Registry Key Manipulation",704333ca-cc12-4bcf-9916-101844881f54,command_prompt
execution,T1047,Windows Management Instrumentation,1,WMI Reconnaissance Users,c107778c-dcf5-47c5-af2e-1d058a3df3ea,command_prompt
execution,T1047,Windows Management Instrumentation,2,WMI Reconnaissance Processes,5750aa16-0e59-4410-8b9a-8a47ca2788e2,command_prompt
execution,T1047,Windows Management Instrumentation,3,WMI Reconnaissance Software,718aebaa-d0e0-471a-8241-c5afa69c7414,command_prompt
Expand Down Expand Up @@ -951,6 +953,7 @@ persistence,T1053.005,Scheduled Task/Job: Scheduled Task,6,WMI Invoke-CimMethod
persistence,T1053.005,Scheduled Task/Job: Scheduled Task,7,Scheduled Task Executing Base64 Encoded Commands From Registry,e895677d-4f06-49ab-91b6-ae3742d0a2ba,command_prompt
persistence,T1053.005,Scheduled Task/Job: Scheduled Task,8,Import XML Schedule Task with Hidden Attribute,cd925593-fbb4-486d-8def-16cbdf944bf4,powershell
persistence,T1053.005,Scheduled Task/Job: Scheduled Task,9,PowerShell Modify A Scheduled Task,dda6fc7b-c9a6-4c18-b98d-95ec6542af6d,powershell
persistence,T1053.005,Scheduled Task/Job: Scheduled Task,10,"Scheduled Task (""Ghost Task"") via Registry Key Manipulation",704333ca-cc12-4bcf-9916-101844881f54,command_prompt
persistence,T1556.003,Modify Authentication Process: Pluggable Authentication Modules,1,Malicious PAM rule,4b9dde80-ae22-44b1-a82a-644bf009eb9c,sh
persistence,T1556.003,Modify Authentication Process: Pluggable Authentication Modules,2,Malicious PAM rule (freebsd),b17eacac-282d-4ca8-a240-46602cf863e3,sh
persistence,T1556.003,Modify Authentication Process: Pluggable Authentication Modules,3,Malicious PAM module,65208808-3125-4a2e-8389-a0a00e9ab326,sh
Expand Down
3 changes: 3 additions & 0 deletions atomics/Indexes/Indexes-CSV/windows-index.csv
View file
Original file line number Diff line number Diff line change
Expand Up @@ -378,6 +378,7 @@ privilege-escalation,T1053.005,Scheduled Task/Job: Scheduled Task,6,WMI Invoke-C
privilege-escalation,T1053.005,Scheduled Task/Job: Scheduled Task,7,Scheduled Task Executing Base64 Encoded Commands From Registry,e895677d-4f06-49ab-91b6-ae3742d0a2ba,command_prompt
privilege-escalation,T1053.005,Scheduled Task/Job: Scheduled Task,8,Import XML Schedule Task with Hidden Attribute,cd925593-fbb4-486d-8def-16cbdf944bf4,powershell
privilege-escalation,T1053.005,Scheduled Task/Job: Scheduled Task,9,PowerShell Modify A Scheduled Task,dda6fc7b-c9a6-4c18-b98d-95ec6542af6d,powershell
privilege-escalation,T1053.005,Scheduled Task/Job: Scheduled Task,10,"Scheduled Task (""Ghost Task"") via Registry Key Manipulation",704333ca-cc12-4bcf-9916-101844881f54,command_prompt
privilege-escalation,T1546.013,Event Triggered Execution: PowerShell Profile,1,Append malicious start-process cmdlet,090e5aa5-32b6-473b-a49b-21e843a56896,powershell
privilege-escalation,T1548.002,Abuse Elevation Control Mechanism: Bypass User Account Control,1,Bypass UAC using Event Viewer (cmd),5073adf8-9a50-4bd9-b298-a9bd2ead8af9,command_prompt
privilege-escalation,T1548.002,Abuse Elevation Control Mechanism: Bypass User Account Control,2,Bypass UAC using Event Viewer (PowerShell),a6ce9acf-842a-4af6-8f79-539be7608e2b,powershell
Expand Down Expand Up @@ -531,6 +532,7 @@ execution,T1053.005,Scheduled Task/Job: Scheduled Task,6,WMI Invoke-CimMethod Sc
execution,T1053.005,Scheduled Task/Job: Scheduled Task,7,Scheduled Task Executing Base64 Encoded Commands From Registry,e895677d-4f06-49ab-91b6-ae3742d0a2ba,command_prompt
execution,T1053.005,Scheduled Task/Job: Scheduled Task,8,Import XML Schedule Task with Hidden Attribute,cd925593-fbb4-486d-8def-16cbdf944bf4,powershell
execution,T1053.005,Scheduled Task/Job: Scheduled Task,9,PowerShell Modify A Scheduled Task,dda6fc7b-c9a6-4c18-b98d-95ec6542af6d,powershell
execution,T1053.005,Scheduled Task/Job: Scheduled Task,10,"Scheduled Task (""Ghost Task"") via Registry Key Manipulation",704333ca-cc12-4bcf-9916-101844881f54,command_prompt
execution,T1047,Windows Management Instrumentation,1,WMI Reconnaissance Users,c107778c-dcf5-47c5-af2e-1d058a3df3ea,command_prompt
execution,T1047,Windows Management Instrumentation,2,WMI Reconnaissance Processes,5750aa16-0e59-4410-8b9a-8a47ca2788e2,command_prompt
execution,T1047,Windows Management Instrumentation,3,WMI Reconnaissance Software,718aebaa-d0e0-471a-8241-c5afa69c7414,command_prompt
Expand Down Expand Up @@ -614,6 +616,7 @@ persistence,T1053.005,Scheduled Task/Job: Scheduled Task,6,WMI Invoke-CimMethod
persistence,T1053.005,Scheduled Task/Job: Scheduled Task,7,Scheduled Task Executing Base64 Encoded Commands From Registry,e895677d-4f06-49ab-91b6-ae3742d0a2ba,command_prompt
persistence,T1053.005,Scheduled Task/Job: Scheduled Task,8,Import XML Schedule Task with Hidden Attribute,cd925593-fbb4-486d-8def-16cbdf944bf4,powershell
persistence,T1053.005,Scheduled Task/Job: Scheduled Task,9,PowerShell Modify A Scheduled Task,dda6fc7b-c9a6-4c18-b98d-95ec6542af6d,powershell
persistence,T1053.005,Scheduled Task/Job: Scheduled Task,10,"Scheduled Task (""Ghost Task"") via Registry Key Manipulation",704333ca-cc12-4bcf-9916-101844881f54,command_prompt
persistence,T1546.013,Event Triggered Execution: PowerShell Profile,1,Append malicious start-process cmdlet,090e5aa5-32b6-473b-a49b-21e843a56896,powershell
persistence,T1133,External Remote Services,1,Running Chrome VPN Extensions via the Registry 2 vpn extension,4c8db261-a58b-42a6-a866-0a294deedde4,powershell
persistence,T1574.011,Hijack Execution Flow: Services Registry Permissions Weakness,1,Service Registry Permissions Weakness,f7536d63-7fd4-466f-89da-7e48d550752a,powershell
Expand Down
3 changes: 3 additions & 0 deletions atomics/Indexes/Indexes-Markdown/index.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -824,6 +824,7 @@
- Atomic Test #7: Scheduled Task Executing Base64 Encoded Commands From Registry [windows]
- Atomic Test #8: Import XML Schedule Task with Hidden Attribute [windows]
- Atomic Test #9: PowerShell Modify A Scheduled Task [windows]
- Atomic Test #10: Scheduled Task ("Ghost Task") via Registry Key Manipulation [windows]
- T1037 Boot or Logon Initialization Scripts [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- T1150 Plist Modification [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- T1574.007 Path Interception by PATH Environment Variable [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
Expand Down Expand Up @@ -1206,6 +1207,7 @@
- Atomic Test #7: Scheduled Task Executing Base64 Encoded Commands From Registry [windows]
- Atomic Test #8: Import XML Schedule Task with Hidden Attribute [windows]
- Atomic Test #9: PowerShell Modify A Scheduled Task [windows]
- Atomic Test #10: Scheduled Task ("Ghost Task") via Registry Key Manipulation [windows]
- [T1047 Windows Management Instrumentation](../../T1047/T1047.md)
- Atomic Test #1: WMI Reconnaissance Users [windows]
- Atomic Test #2: WMI Reconnaissance Processes [windows]
Expand Down Expand Up @@ -1390,6 +1392,7 @@
- Atomic Test #7: Scheduled Task Executing Base64 Encoded Commands From Registry [windows]
- Atomic Test #8: Import XML Schedule Task with Hidden Attribute [windows]
- Atomic Test #9: PowerShell Modify A Scheduled Task [windows]
- Atomic Test #10: Scheduled Task ("Ghost Task") via Registry Key Manipulation [windows]
- T1205.002 Socket Filters [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- T1156 Malicious Shell Modification [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- T1067 Bootkit [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
Expand Down
3 changes: 3 additions & 0 deletions atomics/Indexes/Indexes-Markdown/windows-index.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -566,6 +566,7 @@
- Atomic Test #7: Scheduled Task Executing Base64 Encoded Commands From Registry [windows]
- Atomic Test #8: Import XML Schedule Task with Hidden Attribute [windows]
- Atomic Test #9: PowerShell Modify A Scheduled Task [windows]
- Atomic Test #10: Scheduled Task ("Ghost Task") via Registry Key Manipulation [windows]
- T1037 Boot or Logon Initialization Scripts [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- T1574.007 Path Interception by PATH Environment Variable [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- T1044 File System Permissions Weakness [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
Expand Down Expand Up @@ -811,6 +812,7 @@
- Atomic Test #7: Scheduled Task Executing Base64 Encoded Commands From Registry [windows]
- Atomic Test #8: Import XML Schedule Task with Hidden Attribute [windows]
- Atomic Test #9: PowerShell Modify A Scheduled Task [windows]
- Atomic Test #10: Scheduled Task ("Ghost Task") via Registry Key Manipulation [windows]
- [T1047 Windows Management Instrumentation](../../T1047/T1047.md)
- Atomic Test #1: WMI Reconnaissance Users [windows]
- Atomic Test #2: WMI Reconnaissance Processes [windows]
Expand Down Expand Up @@ -934,6 +936,7 @@
- Atomic Test #7: Scheduled Task Executing Base64 Encoded Commands From Registry [windows]
- Atomic Test #8: Import XML Schedule Task with Hidden Attribute [windows]
- Atomic Test #9: PowerShell Modify A Scheduled Task [windows]
- Atomic Test #10: Scheduled Task ("Ghost Task") via Registry Key Manipulation [windows]
- T1205.002 Socket Filters [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- T1067 Bootkit [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- T1037 Boot or Logon Initialization Scripts [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
Expand Down
Loading

0 comments on commit da6a051

Please sign in to comment.