diff --git a/atomics/T1003/T1003.md b/atomics/T1003/T1003.md index 69b951b31c..6eb293926c 100644 --- a/atomics/T1003/T1003.md +++ b/atomics/T1003/T1003.md @@ -264,7 +264,8 @@ Manager and administrative permissions. **Supported Platforms:** Windows -#### Run it with these steps! 1. Open Task Manager: +#### Run it with these steps! +1. Open Task Manager: On a Windows system this can be accomplished by pressing CTRL-ALT-DEL and selecting Task Manager or by right-clicking on the task bar and selecting "Task Manager". @@ -294,7 +295,8 @@ Mimikatz. This tool is available at https://github.com/gentilkiwi/mimikatz. |------|-------------|------|---------------| | input_file | Path where resulting dump should be placed | Path | lsass_dump.dmp| -#### Run it with these steps! 1. Open Mimikatz: +#### Run it with these steps! +1. Open Mimikatz: Execute `mimikatz` at a command prompt. 2. Select a Memory Dump: diff --git a/atomics/T1037/T1037.md b/atomics/T1037/T1037.md index 3e0166e461..d4c29e9842 100644 --- a/atomics/T1037/T1037.md +++ b/atomics/T1037/T1037.md @@ -46,7 +46,8 @@ Mac logon script **Supported Platforms:** macOS -#### Run it with these steps! 1. Create the required plist file +#### Run it with these steps! +1. Create the required plist file sudo touch /private/var/root/Library/Preferences/com.apple.loginwindow.plist diff --git a/atomics/T1048/T1048.md b/atomics/T1048/T1048.md index 5a00b61fe8..d58c5220ed 100644 --- a/atomics/T1048/T1048.md +++ b/atomics/T1048/T1048.md @@ -71,7 +71,8 @@ A firewall rule (iptables or firewalld) will be needed to allow exfiltration on **Supported Platforms:** macOS, CentOS, Ubuntu, Linux -#### Run it with these steps! 1. Victim System Configuration: +#### Run it with these steps! +1. Victim System Configuration: mkdir /tmp/victim-staging-area echo "this file will be exfiltrated" > /tmp/victim-staging-area/victim-file.txt diff --git a/atomics/T1086/T1086.md b/atomics/T1086/T1086.md index a96b44643e..467bad7f9a 100644 --- a/atomics/T1086/T1086.md +++ b/atomics/T1086/T1086.md @@ -255,7 +255,8 @@ Invoke-DownloadCradle is used to generate Network and Endpoint artifacts. **Supported Platforms:** Windows -#### Run it with these steps! 1. Open Powershell_ise as a Privileged Account +#### Run it with these steps! +1. Open Powershell_ise as a Privileged Account 2. Invoke-DownloadCradle.ps1 diff --git a/atomics/T1137/T1137.md b/atomics/T1137/T1137.md index 0790a589bb..bf13bfbcdd 100644 --- a/atomics/T1137/T1137.md +++ b/atomics/T1137/T1137.md @@ -58,7 +58,8 @@ Word VBA Macro **Supported Platforms:** Windows -#### Run it with these steps! 1. Open Word +#### Run it with these steps! +1. Open Word 2. Insert tab -> Quick Parts -> Field diff --git a/atomics/T1148/T1148.md b/atomics/T1148/T1148.md index 0b8f4c5e45..d1949496f2 100644 --- a/atomics/T1148/T1148.md +++ b/atomics/T1148/T1148.md @@ -39,7 +39,8 @@ xxx **Supported Platforms:** macOS, Linux -#### Run it with these steps! 1. export HISTCONTROL=ignoreboth +#### Run it with these steps! +1. export HISTCONTROL=ignoreboth 2. echo export "HISTCONTROL=ignoreboth" >> ~/.bash_profile 3. ls 4. whoami > recon.txt diff --git a/atomics/T1150/T1150.md b/atomics/T1150/T1150.md index 1f6d770c66..453ddc9679 100644 --- a/atomics/T1150/T1150.md +++ b/atomics/T1150/T1150.md @@ -16,7 +16,8 @@ Modify MacOS plist file in one of two directories **Supported Platforms:** macOS -#### Run it with these steps! 1. Modify a .plist in +#### Run it with these steps! +1. Modify a .plist in /Library/Preferences diff --git a/atomics/T1151/T1151.md b/atomics/T1151/T1151.md index 6be438079f..ebb3efcc76 100644 --- a/atomics/T1151/T1151.md +++ b/atomics/T1151/T1151.md @@ -17,7 +17,8 @@ Space After Filename **Supported Platforms:** macOS -#### Run it with these steps! 1. echo '#!/bin/bash\necho "print \"hello, world!\"" | /usr/bin/python\nexit' > execute.txt && chmod +x execute.txt +#### Run it with these steps! +1. echo '#!/bin/bash\necho "print \"hello, world!\"" | /usr/bin/python\nexit' > execute.txt && chmod +x execute.txt 2. mv execute.txt "execute.txt " diff --git a/atomics/T1159/T1159.md b/atomics/T1159/T1159.md index 3ff3554f7f..220ef8aba2 100644 --- a/atomics/T1159/T1159.md +++ b/atomics/T1159/T1159.md @@ -17,7 +17,8 @@ Create a plist and execute it **Supported Platforms:** macOS -#### Run it with these steps! 1. Create file - .client +#### Run it with these steps! +1. Create file - .client 2. osascript -e 'tell app "Finder" to display dialog "Hello World"' diff --git a/atomics/T1160/T1160.md b/atomics/T1160/T1160.md index ea38a1eb00..23f6ac69d9 100644 --- a/atomics/T1160/T1160.md +++ b/atomics/T1160/T1160.md @@ -19,7 +19,8 @@ Utilize LaunchDaemon to launch `Hello World` **Supported Platforms:** macOS -#### Run it with these steps! 1. Place the following file (com.example.hello) in /System/Library/LaunchDaemons or /Library/LaunchDaemons +#### Run it with these steps! +1. Place the following file (com.example.hello) in /System/Library/LaunchDaemons or /Library/LaunchDaemons 2. diff --git a/atomics/T1164/T1164.md b/atomics/T1164/T1164.md index e8bcaa2146..ca070549a6 100644 --- a/atomics/T1164/T1164.md +++ b/atomics/T1164/T1164.md @@ -21,7 +21,8 @@ Plist Method **Supported Platforms:** macOS -#### Run it with these steps! 1. create a custom plist: +#### Run it with these steps! +1. create a custom plist: ~/Library/Preferences/com.apple.loginwindow.plist diff --git a/atomics/T1165/T1165.md b/atomics/T1165/T1165.md index 985c25e7a7..d84f360e23 100644 --- a/atomics/T1165/T1165.md +++ b/atomics/T1165/T1165.md @@ -21,7 +21,8 @@ Modify or create an file in StartupItems **Supported Platforms:** macOS -#### Run it with these steps! 1. /Library/StartupItems/StartupParameters.plist +#### Run it with these steps! +1. /Library/StartupItems/StartupParameters.plist diff --git a/atomics/T1166/T1166.md b/atomics/T1166/T1166.md index dabd60f7c5..476bb25b0a 100644 --- a/atomics/T1166/T1166.md +++ b/atomics/T1166/T1166.md @@ -26,7 +26,8 @@ Setuid and Setgid |------|-------------|------|---------------| | payload | hello.c payload | path | hello.c| -#### Run it with these steps! 1. make hello +#### Run it with these steps! +1. make hello 2. sudo chown root hello diff --git a/atomics/T1168/T1168.md b/atomics/T1168/T1168.md index 4a7d095488..afd0f6b914 100644 --- a/atomics/T1168/T1168.md +++ b/atomics/T1168/T1168.md @@ -77,7 +77,8 @@ This test adds persistence via a plist to execute via the macOS Event Monitor Da **Supported Platforms:** macOS, CentOS, Ubuntu, Linux -#### Run it with these steps! 1. Place this file in /etc/emond.d/rules/atomicredteam.plist +#### Run it with these steps! +1. Place this file in /etc/emond.d/rules/atomicredteam.plist diff --git a/atomics/T1173/T1173.md b/atomics/T1173/T1173.md index 8c2e52ef51..31ec2dc2f8 100644 --- a/atomics/T1173/T1173.md +++ b/atomics/T1173/T1173.md @@ -19,7 +19,8 @@ Executes commands via DDE using Microsfot Word **Supported Platforms:** Windows -#### Run it with these steps! Open Microsoft Word +#### Run it with these steps! +Open Microsoft Word Insert tab -> Quick Parts -> Field diff --git a/atomics/T1176/T1176.md b/atomics/T1176/T1176.md index 795670cd6b..e4f150e3d3 100644 --- a/atomics/T1176/T1176.md +++ b/atomics/T1176/T1176.md @@ -21,7 +21,8 @@ xxx **Supported Platforms:** Linux, Windows, macOS -#### Run it with these steps! 1. Navigate to [chrome://extensions](chrome://extensions) and +#### Run it with these steps! +1. Navigate to [chrome://extensions](chrome://extensions) and tick 'Developer Mode'. 2. Click 'Load unpacked extension...' and navigate to @@ -42,7 +43,8 @@ xxx **Supported Platforms:** Linux, Windows, macOS -#### Run it with these steps! 1. Navigate to https://chrome.google.com/webstore/detail/minimum-viable-malicious/odlpfdolehmhciiebahbpnaopneicend +#### Run it with these steps! +1. Navigate to https://chrome.google.com/webstore/detail/minimum-viable-malicious/odlpfdolehmhciiebahbpnaopneicend in Chrome 2. Click 'Add to Chrome' @@ -60,7 +62,8 @@ Create a file called test.wma, with the duration of 30 seconds **Supported Platforms:** Linux, Windows, macOS -#### Run it with these steps! 1. Navigate to [about:debugging](about:debugging) and +#### Run it with these steps! +1. Navigate to [about:debugging](about:debugging) and click "Load Temporary Add-on" 2. Navigate to [manifest.json](./manifest.json) diff --git a/atomics/T1207/T1207.md b/atomics/T1207/T1207.md index 66de9e533b..0d1c0bc6d2 100644 --- a/atomics/T1207/T1207.md +++ b/atomics/T1207/T1207.md @@ -22,7 +22,8 @@ Utilize Mimikatz DCShadow method to simulate behavior of a Domain Controller **Supported Platforms:** Windows -#### Run it with these steps! 1. Start Mimikatz and use !processtoken (and not token::elevate - as it elevates a thread) to escalate to SYSTEM. +#### Run it with these steps! +1. Start Mimikatz and use !processtoken (and not token::elevate - as it elevates a thread) to escalate to SYSTEM. 2. Start another mimikatz with DA privileges. This is the instance which registers a DC and is used to "push" the attributes. 3. lsadump::dcshadow /object:ops-user19$ /attribute:userAccountControl /value:532480 4. lsadump::dcshadow /push