atomic-red-team
atomic-red-team copied to clipboard
redcanaryco
Small and highly portable detection tests based on MITRE's ATT&CK.
Test05 description: |- Launches the NSudo executable for a short period of time and then exits. NSudo download observed after maldoc execution. NSudo is a system management tool for advanced...
**Details:** Added a test to scan for Anonymous Access to AWS S3 **Testing:** Tested in local machine(macOS)
**Details:** Added a new test for T1619 Cloud Storage Object Discovery. **Testing:** Tested on the local machine(macOS)
Hello Team, we have installed AtomicTestHarnesses on remote machine and tried to execute Atomic red team technique T1218.001 3rd,4th,5th,6th and 7th usecases on remote execution. but facing issue while creating...
### Use-cases The Linux Atomic Test [rootkit](https://github.com/redcanaryco/atomic-red-team/tree/8a82e9b66a5b4f4bc5b91089e9f24e0544f20ad7/atomics/T1014) test is not very adequate to test. Simply loading a kernel module is insufficient to test against actual rootkit capabilities. ### Proposal Use...
## **Invoke-AtomicTest T1112 -TestNumbers 2** when I wanted to run the above command, I reviewed the T1112.yaml file and understood there is misleading issue in the description part of the...
### Use-cases I'm unsure if this is the correct template or not. Should this be Idea or Test? No test exists in the repo to support privesc/persistence via the time...
### Use-cases I'm unsure if this is the correct template or not. Should this be Idea or Test? No test exists in the repo to support privesc/persistence via the print...
### Use-cases Using the atomic-red-team for automated pentesting can be difficult because some tests that are not have the executor as "manual", they still need some user interaction for the...
As noted in [this PR](https://github.com/redcanaryco/atomic-red-team/pull/1903) there are several items here that would make great additions to the atomic red team library of scripted attacks. https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
Metadata
Owner
Metadata
Small and highly portable detection tests based on MITRE's ATT&CK.