atomic-red-team
atomic-red-team copied to clipboard
Published
20 hours ago •
redcanaryco
redcanaryco
Develop atomic tests for Sigma rules
Note: This issue is an updated version of #1220. The changes take into account the tests that were created as part of the second sprint of the OSCD initiative
Technique ID: Multiple
Additional Details
- Subject: Sigma project
- Authors: @Neo23x0, @thomaspatzke
- Requirements: Create one Pull Request per atomic test.
Please comment the issue with a task number and rule ID that you are going to work out so the others will not intersect with you.
| Task # | ATT&CK Technique name/link | Date checked | Sigma Rule ID / Link | ART Test Link | Status | Comment |
|---|---|---|---|---|---|---|
| 1 | T1006: Direct Volume Access | 30.05.2021 |
|
Direct Volume Access | Done | |
| 2 | T1036.004: Masquerade Task or Service | 30.05.2021 |
|
Masquerading: Masquerade Task or Service | Done | |
| 3 | T1036.005: Match Legitimate Name or Location | 30.05.2021 |
|
CONTRIBUTE TESTS | Waiting for tests | |
| 4 | T1059.006: Python | 30.05.2021 |
|
CONTRIBUTE TESTS | Waiting for tests | |
| 5 | T1059.007: JavaScript/JScript | 30.05.2021 |
|
CONTRIBUTE TESTS | Waiting for tests | |
| 6 | T1070.003: Clear Command History | 30.05.2021 |
|
Indicator Removal on Host: Clear Command History | Partially done | |
| 7 | T1113: Screen Capture | 30.05.2021 |
|
Screen Capture | Partially done | |
| 8 | T1134.001: Token Impersonation/Theft | 30.05.2021 |
|
Access Token Manipulation: Token Impersonation/Theft | Done | |
| 9 | T1134.002: Create Process with Token | 30.05.2021 |
|
CONTRIBUTE TESTS | Waiting for tests | |
| 10 | T1136.002: Domain Account | 30.05.2021 |
|
Create Account: Domain Account | ||
| 11 | T1137.006: Add-ins | 30.05.2021 |
|
CONTRIBUTE TESTS | Waiting for tests | This task could take a huge amount of time to solve |
| 12 | T1486: Data Encrypted for Impact | 30.05.2021 |
|
CONTRIBUTE TESTS | Waiting for tests | |
| 13 | T1547.008: LSASS Driver | 30.05.2021 |
|
CONTRIBUTE TESTS | Waiting for tests | This task could take a huge amount of time to solve |
| 14 | T1562.006: Indicator Blocking | 30.05.2021 |
|
Impair Defenses: Indicator Blocking | Partially done | |
| 15 | T1569.002: System Services | 30.05.2021 |
|
System Services: Service Execution | Partially done | |
| 16 | T1572: Protocol Tunneling | 30.05.2021 |
|
CONTRIBUTE TESTS | Waiting for tests |
