Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

UAC Bypass #2

Closed
underneith opened this issue Oct 12, 2017 · 2 comments
Closed

UAC Bypass #2

underneith opened this issue Oct 12, 2017 · 2 comments

Comments

@underneith
Copy link

https://github.com/hfiref0x/UACME

Might be worth including those in your UAC testing suite.
@ghost
Copy link

ghost commented Oct 12, 2017

For sure, that is an excellent collection. When we reviewed that tactic, we felt that there is already a reference here: https://attack.mitre.org/wiki/Technique/T1088 . I agree its an excellent set of test, I'm not quite sure how to incorporate it yet. Let me think about that. I'll keep this open until we can come to agreement on best way to include this.

@ghost
Copy link

ghost commented Nov 1, 2017

We agree https://github.com/hfiref0x/UACME is a comprehensive testing tool. For now we have decided to leave it out of the repo since it is a binary. But I encourage people to explore that repo it has the most up to date information on UAC bypasses.

@ghost ghost closed this as completed Nov 1, 2017
ghost pushed a commit that referenced this issue Feb 13, 2018
@ForensicITGuy
Merge pull request #2 from ForensicITGuy/linux-goodness
cba719e 
Linux goodness
nicholasaleks added a commit to nicholasaleks/atomic-red-team that referenced this issue Jul 12, 2018
@nicholasaleks
T1074/collect-n-compress-file-types: Updated typos in atomic test red…
8634293 
…canaryco#2
@nicholasaleks nicholasaleks mentioned this issue Jul 12, 2018
Merged
MHaggis pushed a commit that referenced this issue Jul 16, 2018
@timfrazier1
Merge pull request #2 from redcanaryco/master
79da8c3 
Merging upstream changes
@phr3sh phr3sh mentioned this issue Mar 6, 2019
Closed
keithmccammon pushed a commit that referenced this issue Sep 17, 2019
@sisoma2 @keithmccammon
Executor in Atomic Test #2 changed to Powershell (#504)
edc6609 
The specified test doesn't work in command_prompt.
clr2of8 pushed a commit that referenced this issue Nov 11, 2019
@Andras32 @clr2of8
Multi platform invoke art (#641)
6c3da68 
* Non-Windows OS Support

Added OS Identification to determine tests to run
Added SH and Bash executors for Linux and MacOS
Changed some Print statement oddities in ART
Updated Installation script to work on non-windows machines

* Updated Documentation

Edited the readme to be more OS neutral
Added information for the -force option in the installer
Added instructions for downloading powershell core on Mac and Linux

* Last Bugs

added chown to install script

* Install -force test install path

if (Test-Path $InstallPath){ Remove-Item -Path $InstallPath -Recurse -Force -ErrorAction Stop | Out-Null }

* minor changes 

Write-Host error messages
Installer - Import-Module $modulePath -Force

* Chown weird on MacOS

chown -R $env:SUDO_USER $InstallPath

* README edits

clearing up $home $homedrive shenanigans

* \n in mardown issues

* Readme edits #2
@ravelim ravelim mentioned this issue Mar 8, 2020
Closed
@cnotin cnotin mentioned this issue Jun 15, 2020
Closed
masonharrell added a commit to masonharrell/atomic-red-team that referenced this issue Aug 7, 2020
@masonharrell
added prereq to test redcanaryco#2
0533d02
clr2of8 added a commit that referenced this issue Aug 7, 2020
@masonharrell @clr2of8
added prereq to test #2 (#1185)
cd1c015 
* added prereq to test #2

* Update T1071.001.yaml

remove test "z"

Co-authored-by: Carrie Roberts <[email protected]>
clr2of8 added a commit that referenced this issue Apr 19, 2021
@aw350m33d @remotephone
@cyberbuff @clr2of8 @gregclermont @int5-grey @mrblacyk @sn0w0tter @yugoslavskiy @omkar72 @keithmccammon @mgraeber-rc
[OSCD Sprint #2] Final Pull Request / Summary (#1431)
c14c035 
* Updating T1016 to include macos firewall enumeration

* Tests added

* standardize display name

* Add tests for T1134.001 Access Token Impersonation/Theft (#1236)

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* adding socketfilterfw and cleaning up description formatting, adding description details

* Changing to device manufacturer based test

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* Add test for T1006 Direct Volume Access (#1254)

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* [OSCD] T1036.004: Masquerade Task or Service - 2 tests (#1253)

* T1036.004 - 2 tests added

* Update T1036.004.yaml

Co-authored-by: Carrie Roberts <[email protected]>

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* T1136.002 - 2 tests added (#1252)

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* [OSCD] Create atomic test for T1113 for Windows (#1251)

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* update T1564.002

* update T1564.002

* add Gatekeeper disable; add cleanup for security tools disable; add another launchagent for carbon black defense; remove Gatekeeper disable command from Gatekeeper bypass technique

* Added T1562.006 tests to emulate indicator blocking by modifying configuration files

* split linux and macos tests for TT1518.001; update processes list

* Update T1518.001.yaml

* Removed prereq and fixed command endings

* Indirect command execution - conhost (#1265)

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* [OSCD] Office persiststence :  Office test (#1266)

* Office persiststence :  Office test

* Added technique details

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* Remove index files to avoid CI complaints.

* Grr

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* Update T1518.001.yaml

* [OSCD] Adding T1547.010 (#1264)

* Port monitor addition

* Rename T1547.010.yml to T1547.010.yaml

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* Generate docs from job=validate_atomics_generate_docs branch=oscd

* Fixed typos in test names

Co-authored-by: [email protected] <[email protected]>
Co-authored-by: haresudhan <[email protected]>
Co-authored-by: Carrie Roberts <[email protected]>
Co-authored-by: gregclermont <[email protected]>
Co-authored-by: CircleCI Atomic Red Team doc generator <email>
Co-authored-by: Carl <[email protected]>
Co-authored-by: mrblacyk <[email protected]>
Co-authored-by: sn0w0tter <[email protected]>
Co-authored-by: Yugoslavskiy Daniil <[email protected]>
Co-authored-by: yugoslavskiy <[email protected]>
Co-authored-by: omkargudhate22 <[email protected]>
Co-authored-by: Keith McCammon <[email protected]>
Co-authored-by: Matt Graeber <[email protected]>
Adam-Mashinchi added a commit that referenced this issue Jun 4, 2021
@Adam-Mashinchi
Merge pull request #2 from redcanaryco/master
8abfac8 
Update from Upstream
@cccs-richardh cccs-richardh mentioned this issue Dec 29, 2021
Closed
tenillekay added a commit to tenillekay/atomic-red-team that referenced this issue Aug 1, 2022
@tenillekay
Update T1021.006.yaml
1cc8b37 
Updated Test redcanaryco#2 to make it more complete.
@tenillekay tenillekay mentioned this issue Aug 1, 2022
Merged
clr2of8 pushed a commit that referenced this issue Aug 1, 2022
@tenillekay
Update T1021.006.yaml (#2063)
a6edd37 
Updated Test #2 to make it more complete.
@frack113 frack113 mentioned this issue Aug 31, 2022
Closed
@iai-rsa iai-rsa mentioned this issue Mar 15, 2023
Merged
D4rkCiph3r added a commit to D4rkCiph3r/atomic-red-team that referenced this issue Mar 18, 2023
@D4rkCiph3r
Update T1027.001.yaml
4b2ddac 
Updated the test descriptions for atomic test #1 and redcanaryco#2.
D4rkCiph3r added a commit to D4rkCiph3r/atomic-red-team that referenced this issue Mar 18, 2023
@D4rkCiph3r
Update T1562.yaml
0f0cdf3 
Updated the atomic test(#1, redcanaryco#2) name and description.
Added clean-up commands.
patel-bhavin pushed a commit that referenced this issue Apr 13, 2023
@well123cs
Merge pull request #2 from JaideepPandher/t1046
b5282ed 
Add files via upload
@iai-rsa iai-rsa mentioned this issue Apr 14, 2023
Merged
@jonod8698 jonod8698 mentioned this issue Jun 22, 2023
Merged
prashanthpulisetti added a commit to prashanthpulisetti/atomic-red-team that referenced this issue Jan 18, 2024
@prashanthpulisetti
Update T1020.yaml
70663f6 
Atomic Test redcanaryco#2 - Exfiltration via Encrypted FTP
Simulates encrypted file transfer to an FTP server, representing stealthy data exfiltration methods.
@prashanthpulisetti prashanthpulisetti mentioned this issue Jan 18, 2024
Merged
clr2of8 added a commit that referenced this issue Jan 18, 2024
@prashanthpulisetti @clr2of8
Update T1020.yaml -Add New Atomic Test for T1020 - Exfiltration via E…
b28f61b 
…ncrypted FTP (#2656)

* Update T1020.yaml

Atomic Test #2 - Exfiltration via Encrypted FTP
Simulates encrypted file transfer to an FTP server, representing stealthy data exfiltration methods.

* Update T1020.yaml

updated notes

* Update T1020.yaml

updated line 50

* move notes to description, remove empty tags

---------

Co-authored-by: Carrie Roberts <[email protected]>
@prashanthpulisetti prashanthpulisetti mentioned this issue Jan 19, 2024
Merged
ZitniH added a commit to ZitniH/atomic-red-team that referenced this issue Feb 29, 2024
@ZitniH
Fix T1071.001 Test 2
aa7cf93 
Test redcanaryco#2 for T1071.001 is currently not working properly, since the pre-requisite command is incorrect.
This change is to fix the md and yaml files to update the URL for curl
@ZitniH ZitniH mentioned this issue Feb 29, 2024
Merged
clr2of8 pushed a commit that referenced this issue Mar 1, 2024
@ZitniH
Fix T1071.001 Test 2 (#2713)
13937a1 
Test #2 for T1071.001 is currently not working properly, since the pre-requisite command is incorrect.
This change is to fix the md and yaml files to update the URL for curl
patel-bhavin pushed a commit that referenced this issue Mar 7, 2024
@W00glin
Merge pull request #2 from W00glin/T1613_Dockerfile
e062ea2 
Updated Dockerfile
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@underneith