MSBuild Used By Threat Actors to Deliver RATs Filelessly AA21-076A: TrickBot Malware - DefendEdge SiON These changes allow us to take small steps toward a stronger and more cohesive cybersecurity strategy. Are you tired of forgetting the usernames and passwords you created every time you visit a website?This discrete password journal lets you store your important internet passwords in one convenient place! It was a low volume campaign targeting users in the healthcare and aviation industry sectors. Analysis of the threat actor's indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) indicates a correlation with the group known by the names, Pioneer Kitten and UNC757. This book not only provides helpful tips and advice, but it is jam packed with over 100 worksheets, forms, labels, schedules and everything else you need to organize your life. Let Rick Warren guide you as you learn to live out your true purpose. The Purpose Driven Life is more than a book; it's a road map for your spiritual journey. Set in a dangerous near future world, The Book of M tells the captivating story of a group of ordinary people caught in an extraordinary catastrophe who risk everything to save the ones they love. [ 9 ] This way security software can only detect QakBot artifacts on disk, right before system shutdown, and shortly after system boot. Generate docs from job=generate_and_commit_guids_and_docs branch=mast, Windows Atomic Tests by ATT&CK Tactic & Technique, T1546.001 Change Default File Association, T1546.012 Image File Execution Options Injection, T1574.009 Path Interception by Unquoted Path, T1547.001 Registry Run Keys / Startup Folder, T1574.011 Services Registry Permissions Weakness, T1546.003 Windows Management Instrumentation Event Subscription, T1140 Deobfuscate/Decode Files or Information, T1562.004 Disable or Modify System Firewall, T1070.005 Network Share Connection Removal, T1222.001 Windows File and Directory Permissions Modification, T1016 System Network Configuration Discovery, T1049 System Network Connections Discovery, T1048 Exfiltration Over Alternative Protocol, T1048.003 Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, T1021.003 Distributed Component Object Model, Atomic Test #1: Rubeus asreproast [windows], Atomic Test #1: Hook PowerShell TLS Encrypt/Decrypt Messages [windows], Atomic Test #3: Extracting passwords with findstr [windows], Atomic Test #4: Access unattend.xml [windows], Atomic Test #1: Extract Windows Credential Manager via VBA [windows], Atomic Test #2: Dump credentials from Windows Credential Manager With PowerShell [windows Credentials] [windows], Atomic Test #3: Dump credentials from Windows Credential Manager With PowerShell [web Credentials] [windows], Atomic Test #4: Enumerate credentials from Windows Credential Manager using vaultcmd.exe [Windows Credentials] [windows], Atomic Test #5: Enumerate credentials from Windows Credential Manager using vaultcmd.exe [Web Credentials] [windows], Atomic Test #1: Run Chrome-password Collector [windows], Atomic Test #3: LaZagne - Credentials from Browser [windows], Atomic Test #4: Simulating access to Chrome Login Data [windows], Atomic Test #1: Enumeration for Credentials in Registry [windows], Atomic Test #2: Enumeration for PuTTY Credentials in Registry [windows], Atomic Test #1: DCSync (Active Directory) [windows], T1556.001 Domain Controller Authentication, Atomic Test #2: PowerShell - Prompt User for Password [windows], Atomic Test #1: Crafting Active Directory golden tickets with mimikatz [windows], Atomic Test #2: Crafting Active Directory golden tickets with Rubeus [windows], Atomic Test #1: GPP Passwords (findstr) [windows], Atomic Test #2: GPP Passwords (Get-GPPPassword) [windows], Atomic Test #1: Request for service tickets [windows], Atomic Test #2: Rubeus kerberoast [windows], Atomic Test #3: Extract all accounts in use as SPN using setspn [windows], Atomic Test #4: Request A Single Ticket via PowerShell [windows], Atomic Test #5: Request All Tickets via PowerShell [windows], T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay, Atomic Test #1: Dumping LSA Secrets [windows], Atomic Test #1: Windows Credential Editor [windows], Atomic Test #2: Dump LSASS.exe Memory using ProcDump [windows], Atomic Test #3: Dump LSASS.exe Memory using comsvcs.dll [windows], Atomic Test #4: Dump LSASS.exe Memory using direct system calls and API unhooking [windows], Atomic Test #5: Dump LSASS.exe Memory using NanoDump [windows], Atomic Test #6: Dump LSASS.exe Memory using Windows Task Manager [windows], Atomic Test #7: Offline Credential Theft With Mimikatz [windows], Atomic Test #8: LSASS read with pypykatz [windows], Atomic Test #9: Dump LSASS.exe Memory using Out-Minidump.ps1 [windows], Atomic Test #10: Create Mini Dump of LSASS.exe using ProcDump [windows], Atomic Test #11: Powershell Mimikatz [windows], Atomic Test #12: Dump LSASS with .Net 5 createdump.exe [windows], Atomic Test #13: Dump LSASS.exe using imported Microsoft DLLs [windows], Atomic Test #1: Create Volume Shadow Copy with vssadmin [windows], Atomic Test #2: Copy NTDS.dit from Volume Shadow Copy [windows], Atomic Test #3: Dump Active Directory Database with NTDSUtil [windows], Atomic Test #4: Create Volume Shadow Copy with WMI [windows], Atomic Test #5: Create Volume Shadow Copy remotely with WMI [windows], Atomic Test #6: Create Volume Shadow Copy with Powershell [windows], Atomic Test #7: Create Symlink to Volume Shadow Copy [windows], Atomic Test #3: Packet Capture Windows Command Prompt [windows], Atomic Test #4: Windows Internal Packet Capture [windows], Atomic Test #2: Credential Dumping with NPPSpy [windows], Atomic Test #3: Dump svchost.exe to gather RDP credentials [windows], Atomic Test #1: Password Cracking with Hashcat [windows], Atomic Test #1: Install and Register Password Filter DLL [windows], Atomic Test #1: Brute Force Credentials of all Active Directory domain users via SMB [windows], Atomic Test #2: Brute Force Credentials of single Active Directory domain user via LDAP against domain controller (NTLM or Kerberos) [windows], Atomic Test #1: Password Spray all Domain Users [windows], Atomic Test #2: Password Spray (DomainPasswordSpray) [windows], Atomic Test #3: Password spray all Active Directory domain users with a single password via LDAP against domain controller (NTLM or Kerberos) [windows], Atomic Test #6: ADFS token signing and encryption certificates theft - Local [windows], Atomic Test #7: ADFS token signing and encryption certificates theft - Remote [windows], Atomic Test #1: Registry dump of SAM, creds, and secrets [windows], Atomic Test #2: Registry parse with pypykatz [windows], Atomic Test #3: esentutl.exe SAM copy [windows], Atomic Test #4: PowerDump Registry dump of SAM for hashes and usernames [windows], Atomic Test #5: dump volume shadow copy hives with certutil [windows], Atomic Test #6: dump volume shadow copy hives with System.IO.File [windows], T1111 Two-Factor Authentication Interception, Atomic Test #1: Compress Data for Exfiltration With PowerShell [windows], Atomic Test #1: Compress Data for Exfiltration With Rar [windows], Atomic Test #2: Compress Data and lock with password for Exfiltration with winrar [windows], Atomic Test #3: Compress Data and lock with password for Exfiltration with winzip [windows], Atomic Test #4: Compress Data and lock with password for Exfiltration with 7zip [windows], Atomic Test #1: using device audio capture commandlet [windows], Atomic Test #1: Automated Collection Command Prompt [windows], Atomic Test #2: Automated Collection PowerShell [windows], Atomic Test #3: Recon information for export with PowerShell [windows], Atomic Test #4: Recon information for export with Command Prompt [windows], Atomic Test #1: Utilize Clipboard to store or execute commands from [windows], Atomic Test #2: Execute Commands from Clipboard using PowerShell [windows], Atomic Test #4: Collect Clipboard Data via VBA [windows], Atomic Test #1: Stage data from Discovery.bat [windows], Atomic Test #3: Zip a Folder with PowerShell for Staging in Temp [windows], Atomic Test #1: Email Collection with PowerShell Get-Inbox [windows], Atomic Test #5: Windows Screencapture [windows], Atomic Test #6: Windows Screen Capture (CopyFromScreen) [windows], Atomic Test #1: Attaches Command Prompt as a Debugger to a List of Target Processes [windows], Atomic Test #2: Replace binary of sticky keys [windows], Atomic Test #1: Install AppInit Shim [windows], Atomic Test #1: Application Shim Installation [windows], Atomic Test #2: New shim database files created in the default shim database directory [windows], Atomic Test #3: Registry key creation and/or modification events for SDB [windows], Atomic Test #1: Process Injection via C# [windows], Atomic Test #1: At.exe Scheduled task [windows], T1037 Boot or Logon Initialization Scripts, Atomic Test #1: Bypass UAC using Event Viewer (cmd) [windows], Atomic Test #2: Bypass UAC using Event Viewer (PowerShell) [windows], Atomic Test #3: Bypass UAC using Fodhelper [windows], Atomic Test #4: Bypass UAC using Fodhelper - PowerShell [windows], Atomic Test #5: Bypass UAC using ComputerDefaults (PowerShell) [windows], Atomic Test #6: Bypass UAC by Mocking Trusted Directories [windows], Atomic Test #7: Bypass UAC using sdclt DelegateExecute [windows], Atomic Test #8: Disable UAC using reg.exe [windows], Atomic Test #9: Bypass UAC using SilentCleanup task [windows], Atomic Test #10: UACME Bypass Method 23 [windows], Atomic Test #11: UACME Bypass Method 31 [windows], Atomic Test #12: UACME Bypass Method 33 [windows], Atomic Test #13: UACME Bypass Method 34 [windows], Atomic Test #14: UACME Bypass Method 39 [windows], Atomic Test #15: UACME Bypass Method 56 [windows], Atomic Test #16: UACME Bypass Method 59 [windows], Atomic Test #17: UACME Bypass Method 61 [windows], Atomic Test #1: User scope COR_PROFILER [windows], Atomic Test #2: System Scope COR_PROFILER [windows], Atomic Test #3: Registry-free process scope COR_PROFILER [windows], Atomic Test #1: Change Default File Association [windows], T1546.015 Component Object Model Hijacking, Atomic Test #1: Access Token Manipulation [windows], Atomic Test #1: DLL Search Order Hijacking - amsi.dll [windows], Atomic Test #1: DLL Side-Loading using the Notepad++ GUP.exe binary [windows], Atomic Test #1: Enable Guest account with RDP capability and admin privileges [windows], Atomic Test #2: Activate Guest Account [windows], Atomic Test #1: Process Injection via mavinject.exe [windows], T1574.005 Executable Installer File Permissions Weakness, T1068 Exploitation for Privilege Escalation, Atomic Test #1: IFEO Add Debugger [windows], Atomic Test #2: IFEO Global Flags [windows], Atomic Test #1: Create local account with admin privileges [windows], Atomic Test #1: Netsh Helper DLL Registration [windows], Atomic Test #1: Parent PID Spoofing using PowerShell [windows], Atomic Test #2: Parent PID Spoofing - Spawn from Current Process [windows], Atomic Test #3: Parent PID Spoofing - Spawn from Specified Process [windows], Atomic Test #4: Parent PID Spoofing - Spawn from svchost.exe [windows], Atomic Test #5: Parent PID Spoofing - Spawn from New Process [windows], T1574.007 Path Interception by PATH Environment Variable, T1574.008 Path Interception by Search Order Hijacking, Atomic Test #1: Execution of program.exe as service with unquoted service path [windows], Atomic Test #1: Add Port Monitor persistence in Registry [windows], Atomic Test #1: Append malicious start-process cmdlet [windows], Atomic Test #1: Process Hollowing using PowerShell [windows], Atomic Test #1: Shellcode execution via VBA [windows], Atomic Test #2: Remote Process Injection in LSASS via mimikatz [windows], Atomic Test #2: Reg Key RunOnce [windows], Atomic Test #3: PowerShell Registry RunOnce [windows], Atomic Test #4: Suspicious vbs file run from startup Folder [windows], Atomic Test #5: Suspicious jse file run from startup Folder [windows], Atomic Test #6: Suspicious bat file run from startup Folder [windows], Atomic Test #7: Add Executable Shortcut Link to User Startup Folder [windows], Atomic Test #1: Scheduled Task Startup Script [windows], Atomic Test #2: Scheduled task Local [windows], Atomic Test #3: Scheduled task Remote [windows], Atomic Test #4: Powershell Cmdlet Scheduled Task [windows], Atomic Test #5: Task Scheduler via VBA [windows], Atomic Test #6: WMI Invoke-CimMethod Scheduled Task [windows], Atomic Test #1: Set Arbitrary Binary as Screensaver [windows], Atomic Test #1: Modify SSP configuration in registry [windows], T1574.010 Services File Permissions Weakness, Atomic Test #1: Service Registry Permissions Weakness [windows], Atomic Test #2: Service ImagePath Change with reg.exe [windows], Atomic Test #1: Shortcut Modification [windows], Atomic Test #2: Create shortcut to cmd in startup folders [windows], Atomic Test #1: Named pipe client impersonation [windows], Atomic Test #1: Persistence via WMI Event Subscription [windows], Atomic Test #1: Modify Fax service to run PowerShell [windows], Atomic Test #2: Service Installation CMD [windows], Atomic Test #3: Service Installation PowerShell [windows], Atomic Test #1: Winlogon Shell Key Persistence - PowerShell [windows], Atomic Test #2: Winlogon Userinit Key Persistence - PowerShell [windows], Atomic Test #3: Winlogon Notify Key Logon Persistence - PowerShell [windows], Atomic Test #1: Bitsadmin Download (cmd) [windows], Atomic Test #2: Bitsadmin Download (PowerShell) [windows], Atomic Test #3: Persist, Download, & Execute [windows], Atomic Test #4: Bits download using desktopimgdownldr.exe (cmd) [windows], Atomic Test #1: CMSTP Executing Remote Scriptlet [windows], Atomic Test #2: CMSTP Executing UAC Bypass [windows], Atomic Test #10: Prevent Powershell History Logging [windows], Atomic Test #11: Clear Powershell History by Deleting History File [windows], Atomic Test #2: Delete System Logs Using Clear-EventLog [windows], Atomic Test #3: Clear Event Logs via VBA [windows], T1553.006 Code Signing Policy Modification, Atomic Test #1: Compile After Delivery using csc.exe [windows], Atomic Test #2: Dynamic C# Compile [windows], Atomic Test #1: Compiled HTML Help Local Payload [windows], Atomic Test #2: Compiled HTML Help Remote Payload [windows], Atomic Test #3: Invoke CHM with default Shortcut Command Execution [windows], Atomic Test #4: Invoke CHM with InfoTech Storage Protocol Handler [windows], Atomic Test #5: Invoke CHM Simulate Double click [windows], Atomic Test #6: Invoke CHM with Script Engine and Help Topic [windows], Atomic Test #7: Invoke CHM Shortcut Command with ITS and Help Topic [windows], Atomic Test #1: Control Panel Items [windows], Atomic Test #1: Deobfuscate/Decode Files Or Information [windows], Atomic Test #2: Certutil Rename and Decode [windows], Atomic Test #1: Read volume boot sector via DOS device path (PowerShell) [windows], Atomic Test #1: Disable Windows IIS HTTP Logging [windows], Atomic Test #2: Kill Event Log Service Threads [windows], Atomic Test #3: Impair Windows Audit Log Policy [windows], Atomic Test #4: Clear Windows Audit Policy Config [windows], Atomic Test #5: Disable Event Logging with wevtutil [windows], Atomic Test #1: Disable Microsoft Defender Firewall [windows], Atomic Test #2: Disable Microsoft Defender Firewall via Registry [windows], Atomic Test #3: Allow SMB and RDP on Microsoft Defender Firewall [windows], Atomic Test #4: Opening ports for proxy - HARDRAIN [windows], Atomic Test #5: Open a local port through Windows Firewall to any profile [windows], Atomic Test #6: Allow Executable Through Firewall Located in Non-Standard Location [windows], Atomic Test #10: Unload Sysmon Filter Driver [windows], Atomic Test #11: Uninstall Sysmon [windows], Atomic Test #12: AMSI Bypass - AMSI InitFailed [windows], Atomic Test #13: AMSI Bypass - Remove AMSI Provider Reg Key [windows], Atomic Test #14: Disable Arbitrary Security Windows Service [windows], Atomic Test #15: Tamper with Windows Defender ATP PowerShell [windows], Atomic Test #16: Tamper with Windows Defender Command Prompt [windows], Atomic Test #17: Tamper with Windows Defender Registry [windows], Atomic Test #18: Disable Microsoft Office Security Features [windows], Atomic Test #19: Remove Windows Defender Definition Files [windows], Atomic Test #20: Stop and Remove Arbitrary Security Windows Service [windows], Atomic Test #21: Uninstall Crowdstrike Falcon on Windows [windows], Atomic Test #22: Tamper with Windows Defender Evade Scanning -Folder [windows], Atomic Test #23: Tamper with Windows Defender Evade Scanning -Extension [windows], Atomic Test #24: Tamper with Windows Defender Evade Scanning -Process [windows], Atomic Test #4: Delete a single file - Windows cmd [windows], Atomic Test #5: Delete an entire folder - Windows cmd [windows], Atomic Test #6: Delete a single file - Windows PowerShell [windows], Atomic Test #7: Delete an entire folder - Windows PowerShell [windows], Atomic Test #9: Delete Prefetch File [windows], Atomic Test #10: Delete TeamViewer Log Files [windows], T1222 File and Directory Permissions Modification, Atomic Test #3: Create Windows System File with Attrib [windows], Atomic Test #4: Create Windows Hidden File with Attrib [windows], Atomic Test #1: Extract binary files via VBA [windows], Atomic Test #2: Create a Hidden User Called "$" [windows], Atomic Test #3: Create an "Administrator " user (with a space on the end) [windows], Atomic Test #1: Indicator Removal using FSUtil [windows], Atomic Test #1: Indirect Command Execution - pcalua.exe [windows], Atomic Test #2: Indirect Command Execution - forfiles.exe [windows], Atomic Test #3: Indirect Command Execution - conhost.exe [windows], Atomic Test #4: Install root CA on Windows [windows], Atomic Test #5: Install root CA on Windows with certutil [windows], Atomic Test #1: CheckIfInstallable method call [windows], Atomic Test #2: InstallHelper method call [windows], Atomic Test #3: InstallUtil class constructor method call [windows], Atomic Test #4: InstallUtil Install method call [windows], Atomic Test #5: InstallUtil Uninstall method call - /U variant [windows], Atomic Test #6: InstallUtil Uninstall method call - '/installtype=notransaction /action=uninstall' variant [windows], Atomic Test #7: InstallUtil HelpText method call [windows], Atomic Test #8: InstallUtil evasive invocation [windows], Atomic Test #1: MSBuild Bypass Using Inline Tasks (C#) [windows], Atomic Test #2: MSBuild Bypass Using Inline Tasks (VB) [windows], Atomic Test #1: Mount ISO image [windows], Atomic Test #2: Mount an ISO image and run executable from the ISO [windows], Atomic Test #3: Remove the Zone.Identifier alternate data stream [windows], Atomic Test #1: Creating W32Time similar named service using schtasks [windows], Atomic Test #2: Creating W32Time similar named service using sc [windows], Atomic Test #1: System File Copied to Unusual Location [windows], T1036.005 Match Legitimate Name or Location, Atomic Test #1: Modify Registry of Current User Profile - cmd [windows], Atomic Test #2: Modify Registry of Local Machine - cmd [windows], Atomic Test #3: Modify registry to store logon credentials [windows], Atomic Test #4: Add domain to Trusted sites Zone [windows], Atomic Test #5: Javascript in registry [windows], Atomic Test #6: Change Powershell Execution Policy to Bypass [windows], Atomic Test #1: Mshta executes JavaScript Scheme Fetch Remote Payload With GetObject [windows], Atomic Test #2: Mshta executes VBScript to execute malicious command [windows], Atomic Test #3: Mshta Executes Remote HTML Application (HTA) [windows], Atomic Test #4: Invoke HTML Application - Jscript Engine over Local UNC Simulating Lateral Movement [windows], Atomic Test #5: Invoke HTML Application - Jscript Engine Simulating Double Click [windows], Atomic Test #6: Invoke HTML Application - Direct download from URI [windows], Atomic Test #7: Invoke HTML Application - JScript Engine with Rundll32 and Inline Protocol Handler [windows], Atomic Test #8: Invoke HTML Application - JScript Engine with Inline Protocol Handler [windows], Atomic Test #9: Invoke HTML Application - Simulate Lateral Movement over UNC Path [windows], Atomic Test #10: Mshta used to Execute PowerShell [windows], Atomic Test #1: Msiexec.exe - Execute Local MSI file [windows], Atomic Test #2: Msiexec.exe - Execute Remote MSI file [windows], Atomic Test #3: Msiexec.exe - Execute Arbitrary DLL [windows], Atomic Test #1: Alternate Data Streams (ADS) [windows], Atomic Test #2: Store file in Alternate Data Stream (ADS) [windows], Atomic Test #3: Create ADS command prompt [windows], Atomic Test #4: Create ADS PowerShell [windows], Atomic Test #1: Add Network Share [windows], Atomic Test #2: Remove Network Share [windows], Atomic Test #3: Remove Network Share PowerShell [windows], Atomic Test #2: Execute base64-encoded PowerShell [windows], Atomic Test #3: Execute base64-encoded PowerShell from Windows Registry [windows], Atomic Test #4: Execution from Compressed File [windows], Atomic Test #5: DLP Evasion via Sensitive Data in VBA Macro over email [windows], Atomic Test #6: DLP Evasion via Sensitive Data in VBA Macro over HTTP [windows], Atomic Test #7: Obfuscated Command in PowerShell [windows], Atomic Test #8: Obfuscated Command Line using special Unicode characters [windows], Atomic Test #1: Odbcconf.exe - Execute Arbitrary DLL [windows], Atomic Test #1: Mimikatz Pass the Hash [windows], Atomic Test #2: crackmapexec Pass the Hash [windows], Atomic Test #1: Mimikatz Kerberos Ticket Attack [windows], Atomic Test #1: PubPrn.vbs Signed Script Bypass [windows], Atomic Test #1: Regasm Uninstall Method Call Test [windows], Atomic Test #2: Regsvcs Uninstall Method Call Test [windows], Atomic Test #1: Regsvr32 local COM scriptlet execution [windows], Atomic Test #2: Regsvr32 remote COM scriptlet execution [windows], Atomic Test #3: Regsvr32 local DLL execution [windows], Atomic Test #4: Regsvr32 Registering Non DLL [windows], Atomic Test #5: Regsvr32 Silent DLL Install Call DllRegisterServer [windows], Atomic Test #1: Masquerading as Windows LSASS process [windows], Atomic Test #3: Masquerading - cscript.exe running as notepad.exe [windows], Atomic Test #4: Masquerading - wscript.exe running as svchost.exe [windows], Atomic Test #5: Masquerading - powershell.exe running as taskhostw.exe [windows], Atomic Test #6: Masquerading - non-windows exe running as windows exe [windows], Atomic Test #7: Masquerading - windows exe running as different windows exe [windows], Atomic Test #8: Malicious process Masquerading as LSM.exe [windows], Atomic Test #9: File Extension Masquerading [windows], Atomic Test #1: DCShadow (Active Directory) [windows], Atomic Test #3: Windows Signed Driver Rootkit Test [windows], Atomic Test #1: Rundll32 execute JavaScript Remote Payload With GetObject [windows], Atomic Test #2: Rundll32 execute VBscript command [windows], Atomic Test #3: Rundll32 advpack.dll Execution [windows], Atomic Test #4: Rundll32 ieadvpack.dll Execution [windows], Atomic Test #5: Rundll32 syssetup.dll Execution [windows], Atomic Test #6: Rundll32 setupapi.dll Execution [windows], Atomic Test #7: Execution of HTA and VBS Files using Rundll32 and URL.dll [windows], Atomic Test #8: Launches an executable using Rundll32 and pcwutl.dll [windows], T1553.003 SIP and Trust Provider Hijacking, Atomic Test #1: mavinject - Inject DLL into running process [windows], Atomic Test #2: SyncAppvPublishingServer - Execute arbitrary PowerShell code [windows], Atomic Test #3: Register-CimProvider - Execute evil dll [windows], Atomic Test #4: InfDefaultInstall.exe .inf Execution [windows], Atomic Test #5: ProtocolHandler.exe Downloaded a Suspicious File [windows], Atomic Test #6: Microsoft.Workflow.Compiler.exe Payload Execution [windows], Atomic Test #7: Renamed Microsoft.Workflow.Compiler.exe Payload Executions [windows], Atomic Test #8: Invoke-ATHRemoteFXvGPUDisablementCommand base test [windows], Atomic Test #1: SyncAppvPublishingServer Signed Script PowerShell Command Execution [windows], Atomic Test #2: manage-bde.wsf Signed Script Command Execution [windows], Atomic Test #2: Detect Virtualization Environment (Windows) [windows], Atomic Test #1: WINWORD Remote Template Injection [windows], Atomic Test #5: Windows - Modify file creation timestamp with PowerShell [windows], Atomic Test #6: Windows - Modify file last modified timestamp with PowerShell [windows], Atomic Test #7: Windows - Modify file last access timestamp with PowerShell [windows], Atomic Test #8: Windows - Timestomp a File [windows], T1127 Trusted Developer Utilities Proxy Execution, T1550 Use Alternate Authentication Material, Atomic Test #1: Take ownership using takeown utility [windows], Atomic Test #2: cacls - Grant permission to specified user or group recursively [windows], Atomic Test #3: attrib - Remove read-only attribute [windows], Atomic Test #4: attrib - hide file [windows], Atomic Test #5: Grant Full Access to folder for Everyone - Ryuk Ransomware Style [windows], Atomic Test #1: MSXSL Bypass using local files [windows], Atomic Test #2: MSXSL Bypass using remote files [windows], Atomic Test #3: WMIC bypass using local XSL file [windows], Atomic Test #4: WMIC bypass using remote XSL file [windows], Atomic Test #1: Admin Account Manipulate [windows], Atomic Test #2: Domain Account and Group Manipulate [windows], Atomic Test #1: Code Executed Via Excel Add-in File (Xll) [windows], Atomic Test #1: Chrome (Developer Mode) [linux, windows, macos], Atomic Test #2: Chrome (Chrome Web Store) [linux, windows, macos], Atomic Test #3: Firefox [linux, windows, macos], Atomic Test #4: Edge Chromium Addon - VPN [windows, macos], Atomic Test #1: Create a new Windows domain admin user [windows], Atomic Test #2: Create a new account similar to ANONYMOUS LOGON [windows], Atomic Test #3: Create a new Domain Account using PowerShell [windows], T1098.002 Exchange Email Delegate Permissions, Atomic Test #1: Running Chrome VPN Extensions via the Registry 2 vpn extension [windows], Atomic Test #3: Create a new user in a command prompt [windows], Atomic Test #4: Create a new user in PowerShell [windows], Atomic Test #6: Create a new Windows admin user [windows], Atomic Test #1: Office Application Startup - Outlook as a C2 [windows], Atomic Test #1: Office Application Startup Test Persistence [windows], Atomic Test #1: Install Outlook Home Page Persistence [windows], Atomic Test #1: Install MS Exchange Transport Agent Persistence [windows], Atomic Test #1: Web Shell Written to Disk [windows], Atomic Test #1: Change User Password - Windows [windows], Atomic Test #2: Delete User - Windows [windows], Atomic Test #3: Remove Account From Domain Admin Group [windows], T1499.004 Application or System Exploitation, Atomic Test #1: Windows - Overwrite file with Sysinternals SDelete [windows], Atomic Test #5: PureLocker Ransom Note [windows], Atomic Test #1: Windows - Delete Volume Shadow Copies [windows], Atomic Test #2: Windows - Delete Volume Shadow Copies via WMI [windows], Atomic Test #3: Windows - wbadmin Delete Windows Backup Catalog [windows], Atomic Test #4: Windows - Disable Windows Recovery Console Repair [windows], Atomic Test #5: Windows - Delete Volume Shadow Copies via WMI with PowerShell [windows], Atomic Test #6: Windows - Delete Backup Files [windows], Atomic Test #7: Windows - wbadmin Delete systemstatebackup [windows], Atomic Test #8: Windows - Disable the SR scheduled task [windows], Atomic Test #1: Replace Desktop Wallpaper [windows], Atomic Test #1: Windows - Stop service using Service Controller [windows], Atomic Test #2: Windows - Stop service using net.exe [windows], Atomic Test #3: Windows - Stop service by killing process [windows], Atomic Test #1: Shutdown System - Windows [windows], Atomic Test #2: Restart System - Windows [windows], Atomic Test #1: List Process Main Windows - C# .NET [windows], Atomic Test #4: List Google Chrome Bookmarks on Windows with powershell [windows], Atomic Test #5: List Google Chrome / Edge Chromium Bookmarks on Windows with command prompt [windows], Atomic Test #6: List Mozilla Firefox bookmarks on Windows with command prompt [windows], Atomic Test #7: List Internet Explorer Bookmarks using the command prompt [windows], Atomic Test #1: Enumerate all accounts (Domain) [windows], Atomic Test #2: Enumerate all accounts via PowerShell (Domain) [windows], Atomic Test #3: Enumerate logged on users via CMD (Domain) [windows], Atomic Test #4: Automated AD Recon (ADRecon) [windows], Atomic Test #5: Adfind -Listing password policy [windows], Atomic Test #6: Adfind - Enumerate Active Directory Admins [windows], Atomic Test #7: Adfind - Enumerate Active Directory User Objects [windows], Atomic Test #8: Adfind - Enumerate Active Directory Exchange AD Objects [windows], Atomic Test #9: Enumerate Default Domain Admin Details (Domain) [windows], Atomic Test #10: Enumerate Active Directory for Unconstrained Delegation [windows], Atomic Test #1: Basic Permission Groups Discovery Windows (Domain) [windows], Atomic Test #2: Permission Groups Discovery PowerShell (Domain) [windows], Atomic Test #3: Elevated group enumeration using net group (Domain) [windows], Atomic Test #4: Find machines where user has local admin access (PowerView) [windows], Atomic Test #5: Find local admins on all machines in domain (PowerView) [windows], Atomic Test #6: Find Local Admins via Group Policy (PowerView) [windows], Atomic Test #7: Enumerate Users Not Requiring Pre Auth (ASRepRoast) [windows], Atomic Test #8: Adfind - Query Active Directory Groups [windows], Atomic Test #1: Windows - Discover domain trusts with dsquery [windows], Atomic Test #2: Windows - Discover domain trusts with nltest [windows], Atomic Test #3: Powershell enumerate domains and forests [windows], Atomic Test #4: Adfind - Enumerate Active Directory OUs [windows], Atomic Test #5: Adfind - Enumerate Active Directory Trusts [windows], Atomic Test #6: Get-DomainTrust with PowerView [windows], Atomic Test #7: Get-ForestTrust with PowerView [windows], Atomic Test #1: File and Directory Discovery (cmd.exe) [windows], Atomic Test #2: File and Directory Discovery (PowerShell) [windows], Atomic Test #8: Enumerate all accounts on Windows (Local) [windows], Atomic Test #9: Enumerate all accounts via PowerShell (Local) [windows], Atomic Test #10: Enumerate logged on users via CMD (Local) [windows], Atomic Test #2: Basic Permission Groups Discovery Windows (Local) [windows], Atomic Test #3: Permission Groups Discovery PowerShell (Local) [windows], Atomic Test #4: SharpHound3 - LocalAdmin [windows], Atomic Test #5: Wmic Group Discovery [windows], Atomic Test #6: WMIObject Group Discovery [windows], Atomic Test #3: Port Scan NMap for Windows [windows], Atomic Test #4: Port Scan using python [windows], Atomic Test #3: Network Share Discovery command prompt [windows], Atomic Test #4: Network Share Discovery PowerShell [windows], Atomic Test #5: View available share drives [windows], Atomic Test #6: Share Discovery with PowerView [windows], Atomic Test #5: Examine local password policy - Windows [windows], Atomic Test #6: Examine domain password policy - Windows [windows], Atomic Test #1: Win32_PnPEntity Hardware Inventory [windows], Atomic Test #2: Process Discovery - tasklist [windows], Atomic Test #1: Remote System Discovery - net [windows], Atomic Test #2: Remote System Discovery - net group Domain Computers [windows], Atomic Test #3: Remote System Discovery - nltest [windows], Atomic Test #4: Remote System Discovery - ping sweep [windows], Atomic Test #5: Remote System Discovery - arp [windows], Atomic Test #8: Remote System Discovery - nslookup [windows], Atomic Test #9: Remote System Discovery - adidnsdump [windows], Atomic Test #10: Adfind - Enumerate Active Directory Computer Objects [windows], Atomic Test #11: Adfind - Enumerate Active Directory Domain Controller Objects [windows], Atomic Test #1: Security Software Discovery [windows], Atomic Test #2: Security Software Discovery - powershell [windows], Atomic Test #5: Security Software Discovery - Sysmon Service [windows], Atomic Test #6: Security Software Discovery - AV Discovery via WMI [windows], Atomic Test #1: Find and Display Internet Explorer Browser Version [windows], Atomic Test #2: Applications Installed [windows], Atomic Test #1: System Information Discovery [windows], Atomic Test #6: Hostname Discovery (Windows) [windows], Atomic Test #8: Windows MachineGUID Discovery [windows], Atomic Test #10: Environment variables discovery on windows [windows], Atomic Test #1: System Network Configuration Discovery on Windows [windows], Atomic Test #2: List Windows Firewall Rules [windows], Atomic Test #4: System Network Configuration Discovery (TrickBot Style) [windows], Atomic Test #5: List Open Egress Ports [windows], Atomic Test #6: Adfind - Enumerate Active Directory Subnet Objects [windows], Atomic Test #1: System Network Connections Discovery [windows], Atomic Test #2: System Network Connections Discovery with PowerShell [windows], Atomic Test #4: System Discovery using SharpView [windows], Atomic Test #1: System Owner/User Discovery [windows], Atomic Test #3: Find computers where user has session - Stealth mode (PowerView) [windows], Atomic Test #1: System Service Discovery [windows], Atomic Test #2: System Service Discovery - net.exe [windows], Atomic Test #1: System Time Discovery [windows], Atomic Test #2: System Time Discovery - PowerShell [windows], T1092 Communication Through Removable Media, Atomic Test #1: DNS Large Query Volume [windows], Atomic Test #2: DNS Regular Beaconing [windows], Atomic Test #3: DNS Long Domain Query [windows], Atomic Test #7: certutil download (urlcache) [windows], Atomic Test #8: certutil download (verifyctl) [windows], Atomic Test #9: Windows - BITSAdmin BITS Download [windows], Atomic Test #10: Windows - PowerShell Download [windows], Atomic Test #11: OSTAP Worming Activity [windows], Atomic Test #12: svchost writing a file to a UNC path [windows], Atomic Test #13: Download a File with Windows Defender MpCmdRun.exe [windows], Atomic Test #15: File Download via PowerShell [windows], Atomic Test #16: File download with finger.exe on Windows [windows], Atomic Test #17: Download a file with IMEWDBLD.exe [windows], Atomic Test #18: Curl Download File [windows], Atomic Test #19: Curl Upload File [windows], Atomic Test #3: portproxy reg key [windows], Atomic Test #1: Testing usage of uncommonly used port with PowerShell [windows], Atomic Test #1: DNS over HTTPS Large Query Volume [windows], Atomic Test #2: DNS over HTTPS Regular Beaconing [windows], Atomic Test #3: DNS over HTTPS Long Domain Query [windows], Atomic Test #1: TeamViewer Files Detected Test on Windows [windows], Atomic Test #2: AnyDesk Files Detected Test on Windows [windows], Atomic Test #3: LogMeIn Files Detected Test on Windows [windows], Atomic Test #4: GoToAssist Files Detected Test on Windows [windows], Atomic Test #5: ScreenConnect Application Download and Install on Windows [windows], Atomic Test #2: XOR Encoded data.
Dbrand Damascus Wallpaper, Vans Women's Doheny Sneaker, Emory And Henry Equestrian Scholarships, Life-changing Quotes From Books, Over Inflated Crossword Clue, Sports Bike Turning Circle, Arctic Blog Extinction, Becks Funeral Home Clayton, Ga, Ge Refrigerator Extension Cord, ,Sitemap,Sitemap