Skip to content

Instantly share code, notes, and snippets.

@keyboardcrunch

keyboardcrunch/pyattck_linux.md

Last active October 25, 2021 02:37
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save keyboardcrunch/ab9d42c26b90af313f43013738a85d5a to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save keyboardcrunch/ab9d42c26b90af313f43013738a85d5a to your computer and use it in GitHub Desktop.
Download ZIP
Linux pyattck data for project
Raw
pyattck_linux.md 
from pyattck import Attck

attack = Attck()

for technique in attack.enterprise.techniques:
    print("# " + technique.name)
    for subtechnique in technique.subtechniques:
        if "Linux" in subtechnique.platforms:
            print("## " + subtechnique.id + " " + subtechnique.name)
            for ref in subtechnique.reference:
                try:
                    print("\r * " + ref["url"])
                except:
                    pass
            print("\r")
            if subtechnique.commands:
                print("Atomic Red Team:\r * https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/%s/%s.md" % (subtechnique.id, subtechnique.id))
            print("\r\n")

Abuse Elevation Control Mechanism

T1548.001 Setuid and Setgid

Atomic Red Team:

T1548.003 Sudo and Sudo Caching

Atomic Red Team:

Access Token Manipulation

Account Access Removal

Account Discovery

T1087.001 Local Account

Atomic Red Team:

T1087.002 Domain Account

Atomic Red Team:

Account Manipulation

T1098.004 SSH Authorized Keys

Atomic Red Team:

Acquire Infrastructure

Active Scanning

Adversary-in-the-Middle

T1557.002 ARP Cache Poisoning

Application Layer Protocol

T1071.001 Web Protocols

Atomic Red Team:

T1071.002 File Transfer Protocols

T1071.003 Mail Protocols

T1071.004 DNS

Atomic Red Team:

Application Window Discovery

Archive Collected Data

T1560.001 Archive via Utility

Atomic Red Team:

T1560.002 Archive via Library

Atomic Red Team:

T1560.003 Archive via Custom Method

Audio Capture

Automated Collection

Automated Exfiltration

BITS Jobs

Boot or Logon Autostart Execution

T1547.006 Kernel Modules and Extensions

Atomic Red Team:

T1547.013 XDG Autostart Entries

Boot or Logon Initialization Scripts

T1037.004 RC Scripts

Atomic Red Team:

Browser Bookmark Discovery

Browser Extensions

Browser Session Hijacking

Brute Force

T1110.001 Password Guessing

Atomic Red Team:

T1110.002 Password Cracking

Atomic Red Team:

T1110.003 Password Spraying

Atomic Red Team:

T1110.004 Credential Stuffing

Atomic Red Team:

Build Image on Host

Clipboard Data

Cloud Infrastructure Discovery

Cloud Service Dashboard

Cloud Service Discovery

Cloud Storage Object Discovery

Command and Scripting Interpreter

T1059.004 Unix Shell

Atomic Red Team:

T1059.005 Visual Basic

Atomic Red Team:

T1059.006 Python

Atomic Red Team:

T1059.007 JavaScript

Atomic Red Team:

Commonly Used Port

Communication Through Removable Media

Component Object Model and Distributed COM

Compromise Accounts

Compromise Client Software Binary

Compromise Infrastructure

Container Administration Command

Container and Resource Discovery

Create Account

T1136.001 Local Account

Atomic Red Team:

T1136.002 Domain Account

Atomic Red Team:

Create or Modify System Process

T1543.002 Systemd Service

Atomic Red Team:

Credentials from Password Stores

T1555.002 Securityd Memory

T1555.003 Credentials from Web Browsers

Atomic Red Team:

T1555.005 Password Managers

Data Destruction

Data Encoding

T1132.001 Standard Encoding

Atomic Red Team:

T1132.002 Non-Standard Encoding

Data Encrypted for Impact

Data Manipulation

T1565.001 Stored Data Manipulation

Atomic Red Team:

T1565.002 Transmitted Data Manipulation

T1565.003 Runtime Data Manipulation

Data Obfuscation

T1001.001 Junk Data

T1001.002 Steganography

T1001.003 Protocol Impersonation

Data Staged

T1074.001 Local Data Staging

Atomic Red Team:

T1074.002 Remote Data Staging

Data Transfer Size Limits

Data from Cloud Storage Object

Data from Configuration Repository

Data from Information Repositories

Data from Local System

Data from Network Shared Drive

Data from Removable Media

Defacement

T1491.001 Internal Defacement

Atomic Red Team:

T1491.002 External Defacement

Deobfuscate/Decode Files or Information

Deploy Container

Develop Capabilities

Direct Volume Access

Disk Wipe

T1561.001 Disk Content Wipe

T1561.002 Disk Structure Wipe

Domain Policy Modification

Domain Trust Discovery

Drive-by Compromise

Dynamic Resolution

T1568.001 Fast Flux DNS

T1568.002 Domain Generation Algorithms

T1568.003 DNS Calculation

Email Collection

T1114.003 Email Forwarding Rule

Encrypted Channel

T1573.001 Symmetric Cryptography

T1573.002 Asymmetric Cryptography

Endpoint Denial of Service

T1499.001 OS Exhaustion Flood

T1499.002 Service Exhaustion Flood

T1499.003 Application Exhaustion Flood

T1499.004 Application or System Exploitation

Escape to Host

Establish Accounts

Event Triggered Execution

T1546.004 Unix Shell Configuration Modification

Atomic Red Team:

T1546.005 Trap

Atomic Red Team:

Execution Guardrails

T1480.001 Environmental Keying

Exfiltration Over Alternative Protocol

T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol

T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

T1048.003 Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol

Atomic Red Team:

Exfiltration Over C2 Channel

Exfiltration Over Other Network Medium

T1011.001 Exfiltration Over Bluetooth

Exfiltration Over Physical Medium

T1052.001 Exfiltration over USB

Exfiltration Over Web Service

T1567.001 Exfiltration to Code Repository

T1567.002 Exfiltration to Cloud Storage

Exploit Public-Facing Application

Exploitation for Client Execution

Exploitation for Credential Access

Exploitation for Defense Evasion

Exploitation for Privilege Escalation

Exploitation of Remote Services

External Remote Services

Fallback Channels

File and Directory Discovery

File and Directory Permissions Modification

T1222.002 Linux and Mac File and Directory Permissions Modification

Atomic Red Team:

Firmware Corruption

Forced Authentication

Forge Web Credentials

T1606.001 Web Cookies

Gather Victim Host Information

Gather Victim Identity Information

Gather Victim Network Information

Gather Victim Org Information

Graphical User Interface

Group Policy Discovery

Hardware Additions

Hide Artifacts

T1564.001 Hidden Files and Directories

Atomic Red Team:

T1564.005 Hidden File System

T1564.006 Run Virtual Instance

T1564.007 VBA Stomping

T1564.008 Email Hiding Rules

Hijack Execution Flow

T1574.006 Dynamic Linker Hijacking

Atomic Red Team:

Hypervisor

Impair Defenses

T1562.001 Disable or Modify Tools

Atomic Red Team:

T1562.003 Impair Command History Logging

Atomic Red Team:

T1562.004 Disable or Modify System Firewall

Atomic Red Team:

T1562.006 Indicator Blocking

Atomic Red Team:

T1562.010 Downgrade Attack

Implant Internal Image

Indicator Removal on Host

T1070.002 Clear Linux or Mac System Logs

Atomic Red Team:

T1070.003 Clear Command History

Atomic Red Team:

T1070.004 File Deletion

Atomic Red Team:

T1070.006 Timestomp

Atomic Red Team:

Indirect Command Execution

Ingress Tool Transfer

Inhibit System Recovery

Input Capture

T1056.001 Keylogging

Atomic Red Team:

T1056.002 GUI Input Capture

Atomic Red Team:

T1056.003 Web Portal Capture

Inter-Process Communication

Internal Spearphishing

LC_MAIN Hijacking

Lateral Tool Transfer

Masquerading

T1036.002 Right-to-Left Override

T1036.003 Rename System Utilities

Atomic Red Team:

T1036.004 Masquerade Task or Service

Atomic Red Team:

T1036.005 Match Legitimate Name or Location

Atomic Red Team:

T1036.006 Space after Filename

Modify Authentication Process

T1556.003 Pluggable Authentication Modules

Atomic Red Team:

Modify Cloud Compute Infrastructure

Modify Registry

Modify System Image

Multi-Stage Channels

Multiband Communication

Native API

Network Boundary Bridging

Network Denial of Service

T1498.001 Direct Network Flood

T1498.002 Reflection Amplification

Network Service Scanning

Network Share Discovery

Network Sniffing

Non-Application Layer Protocol

Non-Standard Port

OS Credential Dumping

T1003.007 Proc Filesystem

Atomic Red Team:

T1003.008 /etc/passwd and /etc/shadow

Atomic Red Team:

Obfuscated Files or Information

T1027.001 Binary Padding

Atomic Red Team:

T1027.003 Steganography

T1027.004 Compile After Delivery

Atomic Red Team:

T1027.005 Indicator Removal from Tools

T1027.006 HTML Smuggling

Obtain Capabilities

Office Application Startup

Password Policy Discovery

Path Interception

Peripheral Device Discovery

Permission Groups Discovery

T1069.001 Local Groups

Atomic Red Team:

T1069.002 Domain Groups

Atomic Red Team:

Phishing

T1566.001 Spearphishing Attachment

Atomic Red Team:

T1566.002 Spearphishing Link

T1566.003 Spearphishing via Service

Phishing for Information

Pre-OS Boot

T1542.003 Bootkit

Process Discovery

Process Injection

T1055.008 Ptrace System Calls

T1055.009 Proc Memory

T1055.014 VDSO Hijacking

Protocol Tunneling

Proxy

T1090.001 Internal Proxy

Atomic Red Team:

T1090.002 External Proxy

T1090.003 Multi-hop Proxy

T1090.004 Domain Fronting

Query Registry

Redundant Access

Reflective Code Loading

Remote Access Software

Remote Service Session Hijacking

T1563.001 SSH Hijacking

Remote Services

T1021.004 SSH

Atomic Red Team:

T1021.005 VNC

Remote System Discovery

Replication Through Removable Media

Resource Hijacking

Rogue Domain Controller

Rootkit

Scheduled Task/Job

T1053.001 At (Linux)

Atomic Red Team:

T1053.003 Cron

Atomic Red Team:

T1053.006 Systemd Timers

Atomic Red Team:

Scheduled Transfer

Screen Capture

Scripting

Search Closed Sources

Search Open Technical Databases

Search Open Websites/Domains

Search Victim-Owned Websites

Server Software Component

T1505.001 SQL Stored Procedures

T1505.002 Transport Agent

Atomic Red Team:

T1505.003 Web Shell

Atomic Red Team:

Service Stop

Shared Modules

Shared Webroot

Signed Binary Proxy Execution

Signed Script Proxy Execution

Software Deployment Tools

Software Discovery

T1518.001 Security Software Discovery

Atomic Red Team:

Source

Stage Capabilities

Steal Application Access Token

Steal Web Session Cookie

Steal or Forge Kerberos Tickets

Subvert Trust Controls

T1553.004 Install Root Certificate

Atomic Red Team:

Supply Chain Compromise

T1195.001 Compromise Software Dependencies and Development Tools

T1195.002 Compromise Software Supply Chain

T1195.003 Compromise Hardware Supply Chain

System Information Discovery

System Location Discovery

T1614.001 System Language Discovery

System Network Configuration Discovery

T1016.001 Internet Connection Discovery

System Network Connections Discovery

System Owner/User Discovery

System Service Discovery

System Services

System Shutdown/Reboot

System Time Discovery

Taint Shared Content

Template Injection

Traffic Signaling

T1205.001 Port Knocking

Transfer Data to Cloud Account

Trusted Developer Utilities Proxy Execution

Trusted Relationship

Two-Factor Authentication Interception

Unsecured Credentials

T1552.001 Credentials In Files

Atomic Red Team:

T1552.003 Bash History

Atomic Red Team:

T1552.004 Private Keys

Atomic Red Team:

Unused/Unsupported Cloud Regions

Use Alternate Authentication Material

User Execution

T1204.001 Malicious Link

T1204.002 Malicious File

Atomic Red Team:

Valid Accounts

T1078.001 Default Accounts

Atomic Red Team:

T1078.002 Domain Accounts

T1078.003 Local Accounts

Atomic Red Team:

Video Capture

Virtualization/Sandbox Evasion

T1497.001 System Checks

Atomic Red Team:

T1497.002 User Activity Based Checks

T1497.003 Time Based Evasion

Atomic Red Team:

Weaken Encryption

Web Service

T1102.001 Dead Drop Resolver

T1102.002 Bidirectional Communication

T1102.003 One-Way Communication

Windows Management Instrumentation

XSL Script Processing

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment