"description: 'The `atd` daemon must be running ' prereq_command: 'systemctl status atd || service atd status ' get_prereq_command: 'echo ''Please start the `atd` daemon (sysv: `service atd start` ; systemd: `systemctl start atd`)'' ' executor: name: sh elevation_required: false command: 'echo "#{at_command}" | at #{time_spec} ' T1053.002: technique: external_references: - source_name: mitre-attack external_id: T1053.002 url: https://attack.mitre.org/techniques/T1053/002 - url: https://twitter.com/leoloobeek/status/939248813465853953 description: Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved December 12, 2017. source_name: Twitter Leoloobeek Scheduled Task - url: https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen description: Satyajit321. (2015, November 3). S" (Indicator: "twitter") "utility has been deprecated in current versions of Windows in favor of schtasks." id: attack-pattern--f3d95a1f-bba2-44ce-9af7-37866cd63fd0 type: attack-pattern kill_chain_phases: - kill_chain_name: mitre-attack phase_name: execution - kill_chain_name: mitre-attack phase_name: persistence - kill_chain_name: mitre-attack phase_name: privilege-escalation modified: '2020-03-24T13:43:40.776Z' created: '2019-11-27T13:52:45.853Z' x_mitre_data_sources: - File monitoring - Process command-line parameters - Process monitoring - Windows event logs x_mitre_version: '1.0' x_mitre_is_subtechnique: true x_mitre_remote_support: true x_mitre_permissions_required: - Administrator x_mitre_detection: |- Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. (Citation: Twitter Leoloobee" (Indicator: "twitter") "s SID-History attributes using the PowerShell Get-ADUser cmdlet (Citation: Microsoft Get-ADUser), especially users who have SID-History values from the same domain. (Citation: AdSecurity SID History Sept 2015) Also monitor account management events on Domain Controllers for successful and failed changes to SID-History. (Citation: AdSecurity SID History Sept 2015) (Citation: Microsoft DsAddSidHistory) Monitor for Windows API calls to the DsAddSidHistory function. (Citation: Microsoft DsAddSidHistory) x_mitre_data_sources: - Windows event logs - Authentication logs - API monitoring x_mitre_platforms: - Windows atomic_tests: [] T1053.005: technique: external_references: - source_name: mitre-attack external_id: T1053.005 url: https://attack.mitre.org/techniques/T1053/005 - url: https://twitter.com/leoloobeek/status/939248813465853953 description: Loobeek, L. (2017, December 8). leoloobeek Sta" (Indicator: "twitter") "tus. Retrieved December 12, 2017. source_name: Twitter Leoloobeek Scheduled Task - url: https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen description: Satyajit321. (2015, November 3). Scheduled Tasks History Retention settings. Retrieved December 12, 2017. source_name: TechNet Forum Scheduled Task Operational Setting - url: https://technet.microsoft.com/library/dd315590.aspx description: Microsoft. (n.d.). General Task Registration. Retrieved December 12, 2017. source_name: TechNet Scheduled Task Events - source_name: Microsoft Scheduled Task Events Win10 url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events description: Microsoft. (2017, May 28). Audit Other Object Access Events. Retrieved June 27, 2019. - url: https://technet.micro" (Indicator: "twitter") "e: true x_mitre_remote_support: true x_mitre_permissions_required: - Administrator x_mitre_detection: |- Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc. Configure event logging for scheduled task creation and changes by enabling the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service. (Citation: TechNet Forum Scheduled Task Operational Setting) Several events will then be logged on scheduled task activity, including: (Citation: TechNet Scheduled Task Events)(Citation: Microsoft Sch" (Indicator: "twitter") "es: - source_name: mitre-attack external_id: T1574.011 url: https://attack.mitre.org/techniques/T1574/011 - external_id: CAPEC-CAPEC source_name: capec url: https://capec.mitre.org/data/definitions/CAPEC.html - source_name: Registry Key Security url: https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-key-security-and-access-rights?redirectedfrom=MSDN description: Microsoft. (2018, May 31). Registry Key Security and Access Rights. Retrieved March 16, 2017. - source_name: Kansa Service related collectors url: https://trustedsignal.blogspot.com/2014/05/kansa-service-related-collectors-and.html description: 'Hull, D.. (2014, May 3). Kansa: Service related collectors and analysis. Retrieved October 10, 2019.' - source_name: Tweet Registry Perms Weakness url: https://twitter.com/r0wdy_/status/936365549553991680 description: "@r0wdy_. (2017, November 30). Service Recovery Par" (Indicator: "twitter"), "- source_name: Blue Cloud of Death url: https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1 description: 'Kunz, Bryce. (2018, May 11). Blue Cloud of Death: Red Teaming Azure. Retrieved October 23, 2019.' - source_name: Blue Cloud of Death Video url: https://www.youtube.com/watch?v=wQ1CuAPnrLM&feature=youtu.be&t=2815 description: 'Kunz, Bruce. (2018, October 14). Blue Cloud of Death: Red Teaming Azure. Retrieved November 21, 2019.' - source_name: Why AAD Service Principals url: https://github.com/microsoft/AzureSuperpowers/blob/master/docs/AzureSuperpowers.md#why-aad-service-principals description: Microsoft. (2019, September 23). Azure Superpowers Lab Manual. Retrieved January 19 2020. - source_name: Demystifying Azure AD Service Principals url: https://nedinthecloud.com/2019/07/16/demystifying-azure-ad-service-principals/ description: Bellavance Ned. (2019, July 16). Dem" (Indicator: "youtube"), "default: echo Hello from Atomic Red Team dependency_executor_name: sh dependencies: - description: 'The `at` and `atd` executables must exist in the PATH ' prereq_command: 'which at && which atd ' get_prereq_command: 'echo ''Please install `at` and `atd`; they were not found in the PATH (Package name: `at`)'' ' - description: 'The `atd` daemon must be running ' prereq_command: 'systemctl status atd || service atd status ' get_prereq_command: 'echo ''Please start the `atd` daemon (sysv: `service atd start` ; systemd: `systemctl start atd`)'' ' executor: name: sh elevation_required: false command: 'echo "#{at_command}" | at #{time_spec} ' T1053.002: technique: external_references: - source_name: mitre-attack external_id: T1053.002 url: https://attack.mitre.org/techniques/T1053/002 - url: https://twitter.com/leoloobeek/status/939248813465853953 d" (Indicator: "twitter"), "escription: Loobeek L. (2017, December 8). leoloobeek Status. Retrieved December 12 2017. source_name: Twitter Leoloobeek Scheduled Task - url: https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen description: Satyajit321. (2015, November 3). Scheduled Tasks History Retention settings. Retrieved December 12 2017. source_name: TechNet Forum Scheduled Task Operational Setting - url: https://technet.microsoft.com/library/dd315590.aspx description: Microsoft. (n.d.). General Task Registration. Retrieved December 12 2017. source_name: TechNet Scheduled Task Events - source_name: Microsoft Scheduled Task Events Win10 url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events description: Microsoft. (2017, May 28). Audit Other Object Access Events. R" (Indicator: "twitter"), "indows event logs x_mitre_version: '1.0' x_mitre_is_subtechnique: true x_mitre_remote_support: true x_mitre_permissions_required: - Administrator x_mitre_detection: |- Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks that do not correlate with known software patch cycles etc. Configure event logging for scheduled task creation and changes by enabling the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service. (Citation: TechNet Forum Scheduled Task Operational Setting) Several events will then be logged on scheduled task activity including: (Citation: TechN" (Indicator: "twitter") "d_keys=$(cat ~/.ssh/authorized_keys); echo $ssh_authorized_keys > ~/.ssh/authorized_keys; fi; ' cleanup_command: 'unset ssh_authorized_keys ' T1053.005: technique: external_references: - source_name: mitre-attack external_id: T1053.005 url: https://attack.mitre.org/techniques/T1053/005 - url: https://twitter.com/leoloobeek/status/939248813465853953 description: Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved December 12, 2017. source_name: Twitter Leoloobeek Scheduled Task - url: https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen description: Satyajit321. (2015, November 3). Scheduled Tasks History Retention settings. Retrieved December 12, 2017. source_name: TechNet Forum Scheduled Task Operational Setting - url: https://technet.microsoft.com/library/dd315590.aspx" (Indicator: "twitter") "h as SYSTEM). id: attack-pattern--005a06c6-14bf-4118-afa0-ebcd8aebb0c9 type: attack-pattern kill_chain_phases: - kill_chain_name: mitre-attack phase_name: execution - kill_chain_name: mitre-attack phase_name: persistence - kill_chain_name: mitre-attack phase_name: privilege-escalation modified: '2020-03-24T13:45:03.730Z' created: '2019-11-27T14:58:00.429Z' x_mitre_version: '1.0' x_mitre_is_subtechnique: true x_mitre_remote_support: true x_mitre_permissions_required: - Administrator x_mitre_detection: |- Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\System32\Tas" (Indicator: "twitter") "ogspot.com/2014/05/kansa-service-related-collectors-and.html description: 'Hull, D.. (2014, May 3). Kansa: Service related collectors and analysis. Retrieved October 10, 2019.' - source_name: Tweet Registry Perms Weakness url: https://twitter.com/r0wdy_/status/936365549553991680 description: "@r0wdy_. (2017, November 30). Service Recovery Parameters. Retrieved April 9 2018." - source_name: Autoruns for Windows url: https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns description: Mark Russinovich. (2019, June 28). Autoruns for Windows v13.96. Retrieved March 13, 2020. object_marking_refs: - marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168 created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5 name: Services Registry Permissions Weakness description: "Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversari" (Indicator: "twitter"), "s Login Data database file:

AppData\Local\Google\Chrome\User
        Data\Default\Login Data

. Monitor file read events of web browser files that contain credentials especially when the reading process is unrelated to the subject web browser. Monitor process execution logs to include PowerShell Transcription focusing on those that perform a combination of behaviors including reading web browser process memory utilizing regular expressions and those that contain numerous keywords for common web applications (Gmail, Twitter, Office365, etc.).' x_mitre_permissions_required: - User x_mitre_contributors: - Ryan Benson, Exabeam - Barry Shteiman, Exabeam - Sylvain Gil, Exabeam - RedHuntLabs, @redhuntlabs x_mitre_data_sources: - File monitoring - API monitoring - PowerShell logs - Process monitoring identifier: T1555.003 atomic_tests: - name: Run Chrome-password Collecto" (Indicator: "twitter"), "ersions/windows/it-pro/windows-server-2003/cc786431(v=ws.10) description: Microsoft. (2009, October 8). How Connection Manager Works. Retrieved April 11, 2018. source_name: Microsoft Connection Manager Oct 2009 - url: https://twitter.com/ItsReallyNick/status/958789644165894146 description: Carr, N. (2018, January 31). Here is some early bad cmstp.exe... Retrieved April 11, 2018. source_name: Twitter CMSTP Usage Jan 2018 - url: https://msitpros.com/?p=3960 description: Moe, O. (2017, August 15). Research on CMSTP.exe. Retrieved April 11, 2018. source_name: MSitPros CMSTP Aug 2017 - url: https://twitter.com/NickTyrer/status/958450014111633408 description: Tyrer, N. (2018, January 30). CMSTP.exe - remote .sct execution applocker bypass. Retrieved April 11, 2018. source_name: Twitter CMSTP Jan 2018 - url: https://github.com/api0cradle/UltimateAppLockerByPassList description: Moe," (Indicator: "twitter"), "ofile leveraged for remote access connections. Adversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) /" (Indicator: "twitter"), ", CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate, signed Microsoft application. CMSTP.exe can also be abused to [Bypass User Access Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) id: attack-pattern--4cbc6a62-9e34-4f94-8a19-5c1a11392a49 type: attack-pattern kill_chain_phases: - kill_chain_name: mitre-attack phase_name: defense-evasion modified: '2020-06-20T22:34:03.247Z' created: '2020-01-23T18:27:30.656Z' x_mitre_co" (Indicator: "twitter"), "provide a high true-positive alert ration. This test just places the files in a non-TeamViewer folder, a detection would just check for a deletion event matching the TeamViewer log file format of TeamViewer_##.log. Upon execution, no output will be displayed. Use File Explorer to verify the folder was deleted. https://twitter.com/SBousseaden/status/1197524463304290305?s=20 supported_platforms: - windows input_arguments: teamviewer_log_file: description: Teamviewer log file to delete. Run the prereq command to create it if it does not exist. type: string default: "$env:TEMP\\TeamViewer_54.log" dependency_executor_name: powershell dependencies: - description: 'The folder to delete must exist on disk at specified location (#{teamviewer_log_file}) ' prereq_command: 'if (Test-Path #{teamviewer_log_file}) {exit 0} else {exit 1} ' get_prereq_command: 'New-Item -Path #{" (Indicator: "twitter"), "url: https://twitter.com/vector_sec/status/896049052642533376 description: vector_sec. (2017, August 11). Defenders watching launches of cmd? What about forfiles?. Retrieved January 22 2018. source_name: VectorSec ForFiles Aug 2017 - url: https://twitter.com/Evi1cg/status/935027922397573120 description: Evi1cg. (2017, November 26). block cmd.exe ? try this :. Retrieved January 22 2018. source_name: Evi1cg Forfiles Nov 2017 - url: https://community.rsa.com/community/products/netwitness/blog/2017/08/14/are-you-looking-out-for-forfilesexe-if-you-are-watching-for-cmdexe description: Partington E. (2017, August 14). Are you looking out for forfiles.exe (if you are watching for cmd.exe). Retrieved January 22 2018. source_name: RSA Forfiles Aug 2017 description: |- Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters." (Indicator: "twitter"), "s Aug 2017)' x_mitre_permissions_required: - User x_mitre_platforms: - Windows x_mitre_is_subtechnique: false identifier: T1202 atomic_tests: - name: Indirect Command Execution - pcalua.exe auto_generated_guid: cecfea7a-5f03-4cdd-8bc8-6f7c22862440 description: | The Program Compatibility Assistant (pcalua.exe) may invoke the execution of programs and commands from a Command-Line Interface. [Reference](https://twitter.com/KyleHanslovan/status/912659279806640128) Upon execution calc.exe should open supported_platforms: - windows input_arguments: payload_path: description: Path to payload type: path default: C:\Windows\System32\calc.exe process: description: Process to execute type: string default: calc.exe executor: command: | pcalua.exe -a #{process} pcalua.exe -a #{payload_path} name: command_pro" (Indicator: "twitter")