Executable Atomic Red Team test cases for exercising this technique in a lab. Copy a command, run it on the listed platform, confirm your detections fire.
command_promptwindowsCompress Data for Exfiltration With Rar
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration.
When the test completes you should find the txt files from the %USERPROFILE% directory compressed in a file called T1560.001-data.rar in the %USERPROFILE% directory
"#{rar_exe}" a -r #{output_file} #{input_path}\*#{file_extension}
command_promptwindowsCompress Data and lock with password for Exfiltration with winrar
Note: Requires winrar installation
rar a -p"blue" hello.rar (VARIANT)
mkdir .\tmp\victim-files
cd .\tmp\victim-files
echo "This file will be encrypted" > .\encrypted_file.txt
"#{rar_exe}" a -hp"blue" hello.rar
dir
command_promptwindowsCompress Data and lock with password for Exfiltration with winzip
Note: Requires winzip installation
wzzip sample.zip -s"blueblue" *.txt (VARIANT)
path=%path%;"C:\Program Files (x86)\winzip"
mkdir .\tmp\victim-files
cd .\tmp\victim-files
echo "This file will be encrypted" > .\encrypted_file.txt
"#{winzip_exe}" -min -a -s"hello" archive.zip *
dir
command_promptwindowsCompress Data and lock with password for Exfiltration with 7zip
Note: This test requires 7zip installation
mkdir $PathToAtomicsFolder\T1560.001\victim-files
cd $PathToAtomicsFolder\T1560.001\victim-files
echo "This file will be encrypted" > .\encrypted_file.txt
"#{7zip_exe}" u archive.7z *txt -pblue
dir
bashelevatedlinux, macosData Compressed - nix - zip
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard zip compression.
zip #{output_file} #{input_files}
shlinux, macosData Compressed - nix - gzip Single File
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard gzip compression.
test -e #{input_file} && gzip -k #{input_file} || (echo '#{input_content}' >> #{input_file}; gzip -k #{input_file})
shlinux, macosData Compressed - nix - tar Folder or File
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard gzip compression.
tar -cvzf #{output_file} #{input_file_folder}
shlinux, macosData Encrypted with zip and gpg symmetric
Encrypt data for exiltration
mkdir -p #{test_folder}
cd #{test_folder}; touch a b c d e f g
zip --password "#{encryption_password}" #{test_folder}/#{test_file} ./*
echo "#{encryption_password}" | gpg --batch --yes --passphrase-fd 0 --output #{test_folder}/#{test_file}.zip.gpg -c #{test_folder}/#{test_file}.zip
ls -l #{test_folder}
bashlinux, macosEncrypts collected data with AES-256 and Base64
An adversary may compress all the collected data, encrypt and send them to a C2 server using base64 encoding.
This atomic test tries to emulate the behaviour of the FLEXIROOT backdoor to archive the collected data. FLEXIROOT typically utilizes AES encryption and base64 encoding to transfer the encrypted data to the C2 server.
In this test, standard zip compression and the OpenSSL library are used to encrypt the compressed data.
https://attack.mitre.org/versions/v7/software/S0267/
zip -r #{input_folder}/#{input_file}.zip #{input_folder}
openssl enc -aes-256-cbc -pass pass:#{enc_pass} -p -in #{input_folder}/#{input_file}.zip -out #{input_folder}/#{input_file}.enc
cat #{input_folder}/#{input_file}.enc | base64
powershellelevatedwindowsESXi - Remove Syslog remote IP
An adversary may edit the syslog config to remove the loghost in order to prevent or redirect logs being received by SIEM.
# Extract line with IP address from the syslog configuration output
#{plink_file} -ssh #{vm_host} -l #{username} -pw #{password} -m PathToAtomicsFolder\..\atomics\T1560.001\src\esxi_get_loghost.txt | findstr /r "[0-9]*\.[0-9]*\.[0-9]*\." > c:\temp\loghost.txt
# Replace the IP with "0"
#{plink_file} -ssh #{vm_host} -l #{username} -pw #{password} -m PathToAtomicsFolder\..\atomics\T1560.001\src\esxi_remove_loghost.txt
# Extract the IP from the line extracted from findstr
$inputFilePath = "c:\temp\loghost.txt"
$outputFilePath = "c:\temp\loghost_ip.txt"
$fileContent = Get-Content -Path $inputFilePath -Raw
if ([string]::IsNullOrWhiteSpace($fileContent)) {
Write-Host "The content is $fileContent"
Write-Host "The file is empty"
} else {
# Use a regular expression to extract IP addresses
$ipAddresses = [regex]::Matches($fileContent, '(udp|tcp):\/\/[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.*').Value
$output = "esxcli system syslog config set --loghost=" + $ipAddresses
$output | Out-File -FilePath $outputFilePath -Encoding ascii
Write-Host "IP addresses extracted and saved to $outputFilePath"
}
command_promptwindowsCompress a File for Exfiltration using Makecab
An adversary may compress data using Makecab (in-built Windows binary) that is collected prior to exfiltration.
[reference](https://unit42.paloaltonetworks.com/exchange-server-credential-harvesting/)
makecab.exe #{input_file} #{output_file}
powershellelevatedwindowsCopy and Compress AppData Folder
Copies the AppData folder, compresses it, and cleans up temporary files.
$AppData="$env:USERPROFILE\AppData"
$Copy="#{destination_folder}"
$Zip="#{zip_file_path}"
if (Test-Path $Copy) { Remove-Item $Copy -Recurse -Force }
New-Item -ItemType Directory -Path $Copy | Out-Null
Get-ChildItem $AppData -Recurse -Force | ForEach-Object {
$rel = $_.FullName.Substring($AppData.Length + 1)
$dest = Join-Path $Copy $rel
if ($_.PSIsContainer) { New-Item -ItemType Directory -Path $dest -Force | Out-Null }
else { Copy-Item $_.FullName -Destination $dest -Force -ErrorAction SilentlyContinue }
}
Add-Type -AssemblyName System.IO.Compression.FileSystem
[System.IO.Compression.ZipFile]::CreateFromDirectory($Copy, $Zip, [System.IO.Compression.CompressionLevel]::Optimal, $false)