Atomic Red Team

This Atomic Red Team test covers techniques where adversaries abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. This can be used for persistence, remote execution (Lateral Movement), or running processes under specific account contexts (e.g., SYSTEM).

Common methods for interacting with the Task Scheduler include:

• Using the schtasks command-line utility.
• Using the Task Scheduler GUI via Administrator Tools.
• Using .NET wrappers for the Windows Task Scheduler.
• Using the Windows netapi32 library.
• Using Windows Management Instrumentation (WMI).
• Using the PowerShell Cmdlet Invoke-CimMethod (leveraging the PS_ScheduledTask WMI class via an XML path).

Adversaries may also attempt to hide tasks from enumeration tools like schtasks /query by deleting associated Security Descriptor (SD) registry values or altering metadata (e.g., Index values) within registry keys.

This Atomic Red Team test covers techniques where adversaries abuse Dynamic-Link Library (DLL) files to achieve persistence, escalate privileges, or evade defenses. The techniques included in this category are:

• DLL Sideloading: Planting a malicious DLL alongside a legitimate application so that when the application is executed, it loads the malicious payload instead of (or in addition to) the intended library.
• DLL Search Order Hijacking: Exploiting the specific sequence Windows uses to search for DLLs by placing a malicious DLL in a directory that is checked before the legitimate library's location.
• DLL Redirection: Modifying the search order via the Registry or redirection files to force a program to load a DLL from an unexpected location.
• Phantom DLL Hijacking: Targeting references to DLL files that do not exist on the system and planting a malicious DLL with the expected name in the location where the system would look for it.
• DLL Substitution: Replacing an existing, valid DLL file with a malicious one of the same name in the same directory.

These techniques are often used to mask malicious activity under the guise of a trusted, legitimate, or elevated process.

The ESXi index provides a categorized list of Atomic Red Team tests specifically designed for VMware ESXi environments, mapped to MITRE ATT&CK tactics and techniques. You can use this index to identify which security controls to validate for specific adversary behaviors on ESXi hosts.

Available tactics include:

• Stealth: Techniques for hiding presence, such as masquerading, indicator removal, and obfuscation.
• Impact: Actions that disrupt service, destroy data, or inhibit system recovery.
• Execution: Methods for running malicious code, including scheduled tasks (Cron), ESXi administration commands, and various scripting interpreters (Bash, Python).
• Lateral Movement: Techniques for moving through the network, such as using SSH or remote services.
• Initial Access: Methods for gaining entry, including exploiting public-facing applications and using valid accounts.
• Exfiltration: Methods for moving data out of the environment via web services, C2 channels, or alternative protocols.
• Defense Impairment: Actions taken to disable security tools, modify permissions, or prevent command logging.

T1047 refers to the abuse of Windows Management Instrumentation (WMI) for malicious purposes. WMI is a Windows administration feature providing a uniform environment to access system components. Adversaries use it for:

• Discovery: Gathering information about local or remote systems (e.g., reconnaissance of users, processes, or software).
• Execution: Running commands or payloads locally or remotely.
• Inhibit System Recovery: For example, using wmic.exe Shadowcopy Delete to delete shadow copies.

Connectivity Details:

• Remote WMI over DCOM: Uses port 135.
• WMI over WinRM (HTTP): Uses port 5985.
• WMI over WinRM (HTTPS): Uses port 5986.

Note on Deprecation: wmic.exe is deprecated as of January 2024 and is disabled by default on Windows 11+. It is being replaced by PowerShell as the primary WMI interface. Other methods for interacting with WMI include wbemtool.exe and COM APIs (C++, .NET, VBScript, etc.).

The esxi-index.md file provides a categorized index of Atomic Red Team tests specifically designed for VMware ESXi environments. Tests are organized by MITRE ATT&CK tactics, allowing security practitioners to identify and execute simulations for specific adversary behaviors on ESXi hosts.

Available tactics in this index include:

• persistence: Techniques to maintain access (e.g., Scheduled Tasks, Account Manipulation).
• privilege-escalation: Techniques to gain higher permissions (e.g., Escape to Host).
• command-and-control: Communication techniques (e.g., Protocol Tunneling, DNS, Proxying).
• credential-access: Methods to steal credentials (e.g., Brute Force).
• discovery: Methods to gather information about the system (e.g., Account Discovery, Network Configuration).
• collection: Methods to gather data (e.g., Data Staging).
• stealth, impact, execution, lateral-movement, and initial-access (further details available in subsequent segments).