@cyberstrike-io/cyberstrike 1.1.10-beta.2 → 1.1.10-beta.4

package/skill/mitre_attack/TA0040_impact/T1498_network-denial-of-service/SKILL.md

@@ -74,13 +74,15 @@ For DoS attacks targeting the hosting system directly, see Endpoint Denial of Se
 
 ## How to Test
 
-### Identify Attack Surface
+### Manual Testing
 
-Determine if the target environment is susceptible to Network Denial of Service by examining the target platforms (Windows, IaaS, Linux).
+1. **Identify Attack Surface**: Determine if the target environment is susceptible to Network Denial of Service by examining the target platforms (Windows, IaaS, Linux).
 
-### Assess Existing Defenses
+2. **Assess Existing Defenses**: Review whether mitigations for T1498 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
 
-Review whether mitigations for T1498 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.
+
+> **Note**: No Atomic Red Team tests available for this technique. See [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) for updates.
 
 ## Remediation Guide
 
@@ -116,4 +118,5 @@ As immediate response may require rapid engagement of 3rd parties, analyze the r
 - [FSISAC FraudNetDoS September 2012](https://www.ic3.gov/Media/PDF/Y2012/FraudAlertFinancialInstitutionEmployeeCredentialsTargeted.pdf)
 - [FireEye OpPoisonedHandover February 2016](https://web.archive.org/web/20201127180357/https://www.fireeye.com/blog/threat-research/2014/11/operation-poisoned-handover-unveiling-ties-between-apt-activity-in-hong-kongs-pro-democracy-movement.html)
 - [Symantec DDoS October 2014](https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-continued-rise-of-ddos-attacks.pdf)
+- [Atomic Red Team - T1498](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1498)
 - [MITRE ATT&CK - T1498](https://attack.mitre.org/techniques/T1498)

package/skill/mitre_attack/TA0040_impact/T1499.001_os-exhaustion-flood/SKILL.md

@@ -70,13 +70,15 @@ ACK floods leverage the stateful nature of the TCP protocol. A flood of ACK pack
 
 ## How to Test
 
-### Identify Attack Surface
+### Manual Testing
 
-Determine if the target environment is susceptible to OS Exhaustion Flood by examining the target platforms (Linux, macOS, Windows).
+1. **Identify Attack Surface**: Determine if the target environment is susceptible to OS Exhaustion Flood by examining the target platforms (Linux, macOS, Windows).
 
-### Assess Existing Defenses
+2. **Assess Existing Defenses**: Review whether mitigations for T1499.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
 
-Review whether mitigations for T1499.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.
+
+> **Note**: No Atomic Red Team tests available for this technique. See [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) for updates.
 
 ## Remediation Guide
 
@@ -108,4 +110,5 @@ Leverage services provided by Content Delivery Networks (CDN) or providers speci
 - [Cloudflare SynFlood](https://www.cloudflare.com/learning/ddos/syn-flood-ddos-attack/)
 - [Corero SYN-ACKflood](https://web.archive.org/web/20220119104451/https://www.corero.com/resource-hub/syn-ack-flood-attack/)
 - [Arbor AnnualDoSreport Jan 2018](https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf)
+- [Atomic Red Team - T1499.001](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1499.001)
 - [MITRE ATT&CK - T1499.001](https://attack.mitre.org/techniques/T1499/001)

package/skill/mitre_attack/TA0040_impact/T1499.002_service-exhaustion-flood/SKILL.md

@@ -73,13 +73,15 @@ Another variation, known as a SSL renegotiation attack, takes advantage of a pro
 
 ## How to Test
 
-### Identify Attack Surface
+### Manual Testing
 
-Determine if the target environment is susceptible to Service Exhaustion Flood by examining the target platforms (Windows, IaaS, Linux).
+1. **Identify Attack Surface**: Determine if the target environment is susceptible to Service Exhaustion Flood by examining the target platforms (Windows, IaaS, Linux).
 
-### Assess Existing Defenses
+2. **Assess Existing Defenses**: Review whether mitigations for T1499.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
 
-Review whether mitigations for T1499.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.
+
+> **Note**: No Atomic Red Team tests available for this technique. See [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) for updates.
 
 ## Remediation Guide
 
@@ -111,4 +113,5 @@ Leverage services provided by Content Delivery Networks (CDN) or providers speci
 - [Cisco DoSdetectNetflow](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf)
 - [Cloudflare HTTPflood](https://www.cloudflare.com/learning/ddos/http-flood-ddos-attack/)
 - [Arbor AnnualDoSreport Jan 2018](https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf)
+- [Atomic Red Team - T1499.002](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1499.002)
 - [MITRE ATT&CK - T1499.002](https://attack.mitre.org/techniques/T1499/002)

package/skill/mitre_attack/TA0040_impact/T1499.003_application-exhaustion-flood/SKILL.md

@@ -69,13 +69,15 @@ Adversaries may target resource intensive features of applications to cause a de
 
 ## How to Test
 
-### Identify Attack Surface
+### Manual Testing
 
-Determine if the target environment is susceptible to Application Exhaustion Flood by examining the target platforms (Windows, IaaS, Linux).
+1. **Identify Attack Surface**: Determine if the target environment is susceptible to Application Exhaustion Flood by examining the target platforms (Windows, IaaS, Linux).
 
-### Assess Existing Defenses
+2. **Assess Existing Defenses**: Review whether mitigations for T1499.003 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
 
-Review whether mitigations for T1499.003 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.
+
+> **Note**: No Atomic Red Team tests available for this technique. See [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) for updates.
 
 ## Remediation Guide
 
@@ -105,4 +107,5 @@ Leverage services provided by Content Delivery Networks (CDN) or providers speci
 
 - [Cisco DoSdetectNetflow](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf)
 - [Arbor AnnualDoSreport Jan 2018](https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf)
+- [Atomic Red Team - T1499.003](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1499.003)
 - [MITRE ATT&CK - T1499.003](https://attack.mitre.org/techniques/T1499/003)

package/skill/mitre_attack/TA0040_impact/T1499.004_application-or-system-exploitation/SKILL.md

@@ -71,13 +71,15 @@ Adversaries may exploit known or zero-day vulnerabilities to crash applications
 
 ## How to Test
 
-### Identify Attack Surface
+### Manual Testing
 
-Determine if the target environment is susceptible to Application or System Exploitation by examining the target platforms (Windows, IaaS, Linux).
+1. **Identify Attack Surface**: Determine if the target environment is susceptible to Application or System Exploitation by examining the target platforms (Windows, IaaS, Linux).
 
-### Assess Existing Defenses
+2. **Assess Existing Defenses**: Review whether mitigations for T1499.004 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
 
-Review whether mitigations for T1499.004 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.
+
+> **Note**: No Atomic Red Team tests available for this technique. See [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) for updates.
 
 ## Remediation Guide
 
@@ -106,4 +108,5 @@ Leverage services provided by Content Delivery Networks (CDN) or providers speci
 ## References
 
 - [Sucuri BIND9 August 2015](https://blog.sucuri.net/2015/08/bind9-denial-of-service-exploit-in-the-wild.html)
+- [Atomic Red Team - T1499.004](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1499.004)
 - [MITRE ATT&CK - T1499.004](https://attack.mitre.org/techniques/T1499/004)

package/skill/mitre_attack/TA0040_impact/T1499_endpoint-denial-of-service/SKILL.md

@@ -81,13 +81,15 @@ For attacks attempting to saturate the providing network, see Network Denial of
 
 ## How to Test
 
-### Identify Attack Surface
+### Manual Testing
 
-Determine if the target environment is susceptible to Endpoint Denial of Service by examining the target platforms (Windows, Linux, macOS).
+1. **Identify Attack Surface**: Determine if the target environment is susceptible to Endpoint Denial of Service by examining the target platforms (Windows, Linux, macOS).
 
-### Assess Existing Defenses
+2. **Assess Existing Defenses**: Review whether mitigations for T1499 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
 
-Review whether mitigations for T1499 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.
+
+> **Note**: No Atomic Red Team tests available for this technique. See [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) for updates.
 
 ## Remediation Guide
 
@@ -121,4 +123,5 @@ Leverage services provided by Content Delivery Networks (CDN) or providers speci
 - [FireEye OpPoisonedHandover February 2016](https://web.archive.org/web/20201127180357/https://www.fireeye.com/blog/threat-research/2014/11/operation-poisoned-handover-unveiling-ties-between-apt-activity-in-hong-kongs-pro-democracy-movement.html)
 - [USNYAG IranianBotnet March 2016](https://www.justice.gov/opa/pr/seven-iranians-working-islamic-revolutionary-guard-corps-affiliated-entities-charged)
 - [Symantec DDoS October 2014](https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-continued-rise-of-ddos-attacks.pdf)
+- [Atomic Red Team - T1499](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1499)
 - [MITRE ATT&CK - T1499](https://attack.mitre.org/techniques/T1499)

package/skill/mitre_attack/TA0040_impact/T1529_system-shutdownreboot/SKILL.md

@@ -69,13 +69,75 @@ Adversaries may attempt to shutdown/reboot a system after impacting it in other
 
 ## How to Test
 
-### Identify Attack Surface
+### Atomic Red Team Tests
 
-Determine if the target environment is susceptible to System Shutdown/Reboot by examining the target platforms (ESXi, Linux, macOS).
+The following tests are from [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team) and provide actionable ways to test this technique:
 
-### Assess Existing Defenses
+### Atomic Test 1: Shutdown System - Windows
 
-Review whether mitigations for T1529 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+This test shuts down a Windows system.
+
+**Supported Platforms:** windows
+**Elevation Required:** Yes
+
+```cmd
+shutdown /s /t #{timeout}
+```
+
+### Atomic Test 2: Restart System - Windows
+
+This test restarts a Windows system.
+
+**Supported Platforms:** windows
+**Elevation Required:** Yes
+
+```cmd
+shutdown /r /t #{timeout}
+```
+
+### Atomic Test 3: Restart System via `shutdown` - FreeBSD/macOS/Linux
+
+This test restarts a FreeBSD/macOS/Linux system.
+
+**Supported Platforms:** linux, macos
+**Elevation Required:** Yes
+
+```bash
+shutdown -r #{timeout}
+```
+
+### Atomic Test 4: Shutdown System via `shutdown` - FreeBSD/macOS/Linux
+
+This test shuts down a FreeBSD/macOS/Linux system using a halt.
+
+**Supported Platforms:** linux, macos
+**Elevation Required:** Yes
+
+```bash
+shutdown -h #{timeout}
+```
+
+### Atomic Test 5: Restart System via `reboot` - FreeBSD/macOS/Linux
+
+This test restarts a FreeBSD/macOS/Linux system via `reboot`.
+
+**Supported Platforms:** linux, macos
+**Elevation Required:** Yes
+
+```bash
+reboot
+```
+
+
+### Manual Testing
+
+If Atomic Red Team tests are not applicable, manually verify the technique by:
+
+1. **Identify Attack Surface**: Determine if the target environment is susceptible to System Shutdown/Reboot by examining the target platforms (ESXi, Linux, macOS).
+
+2. **Assess Existing Defenses**: Review whether mitigations for T1529 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+
+3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.
 
 ## Remediation Guide
 
@@ -110,4 +172,5 @@ No specific mitigations documented for this technique.
 - [Unit42 Agrius 2023](https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/)
 - [SonicWall](https://www.sonicwall.com/blog/disarming-darkgate-a-deep-dive-into-thwarting-the-latest-darkgate-variant)
 - [CrowdStrike Blog](https://www.crowdstrike.com/en-us/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/)
+- [Atomic Red Team - T1529](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1529)
 - [MITRE ATT&CK - T1529](https://attack.mitre.org/techniques/T1529)

package/skill/mitre_attack/TA0040_impact/T1531_account-access-removal/SKILL.md

@@ -72,13 +72,86 @@ Adversaries who use ransomware or similar attacks may first perform this and oth
 
 ## How to Test
 
-### Identify Attack Surface
+### Atomic Red Team Tests
 
-Determine if the target environment is susceptible to Account Access Removal by examining the target platforms (Linux, macOS, Windows).
+The following tests are from [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team) and provide actionable ways to test this technique:
 
-### Assess Existing Defenses
+### Atomic Test 1: Change User Password - Windows
 
-Review whether mitigations for T1531 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+Changes the user password to hinder access attempts. Seen in use by LockerGoga. Upon execution, log into the user account "AtomicAdministrator" with
+the password "HuHuHUHoHo283283".
+
+**Supported Platforms:** windows
+**Elevation Required:** Yes
+
+```cmd
+net user #{user_account} #{new_user_password} /add
+net.exe user #{user_account} #{new_password}
+```
+
+### Atomic Test 2: Delete User - Windows
+
+Deletes a user account to prevent access. Upon execution, run the command "net user" to verify that the new "AtomicUser" account was deleted.
+
+**Supported Platforms:** windows
+**Elevation Required:** Yes
+
+```cmd
+net user #{user_account} #{new_user_password} /add
+net.exe user #{user_account} /delete
+```
+
+### Atomic Test 3: Remove Account From Domain Admin Group
+
+This test will remove an account from the domain admins group
+
+**Supported Platforms:** windows
+
+```powershell
+$PWord = ConvertTo-SecureString -String #{super_pass} -AsPlainText -Force
+$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList #{super_user}, $PWord
+if((Get-ADUser #{remove_user} -Properties memberof).memberof -like "CN=Domain Admins*"){
+  Remove-ADGroupMember -Identity "Domain Admins" -Members #{remove_user} -Credential $Credential -Confirm:$False
+} else{
+    write-host "Error - Make sure #{remove_user} is in the domain admins group" -foregroundcolor Red
+}
+```
+
+**Dependencies:**
+- Requires the Active Directory module for powershell to be installed.
+
+### Atomic Test 4: Change User Password via passwd
+
+This test changes the user password to hinder access to the account using passwd utility.
+
+**Supported Platforms:** macos, linux
+**Elevation Required:** Yes
+
+```bash
+passwd #{user_account} #enter admin password > enter new password > confirm new password
+```
+
+### Atomic Test 5: Delete User via dscl utility
+
+This test deletes the user account using the dscl utility.
+
+**Supported Platforms:** macos
+**Elevation Required:** Yes
+
+```bash
+dscl . -delete /Users/#{user_account} #enter admin password
+```
+
+
+### Manual Testing
+
+If Atomic Red Team tests are not applicable, manually verify the technique by:
+
+1. **Identify Attack Surface**: Determine if the target environment is susceptible to Account Access Removal by examining the target platforms (Linux, macOS, Windows).
+
+2. **Assess Existing Defenses**: Review whether mitigations for T1531 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+
+3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.
 
 ## Remediation Guide
 
@@ -107,4 +180,5 @@ No specific mitigations documented for this technique.
 - [CarbonBlack LockerGoga 2019](https://www.carbonblack.com/2019/03/22/tau-threat-intelligence-notification-lockergoga-ransomware/)
 - [Unit42 LockerGoga 2019](https://unit42.paloaltonetworks.com/born-this-way-origins-of-lockergoga/)
 - [Obsidian Security SaaS Ransomware June 2023](https://web.archive.org/web/20230608061141/https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/)
+- [Atomic Red Team - T1531](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1531)
 - [MITRE ATT&CK - T1531](https://attack.mitre.org/techniques/T1531)

package/skill/mitre_attack/TA0040_impact/T1561.001_disk-content-wipe/SKILL.md

@@ -70,13 +70,15 @@ To maximize impact on the target organization in operations where network-wide a
 
 ## How to Test
 
-### Identify Attack Surface
+### Manual Testing
 
-Determine if the target environment is susceptible to Disk Content Wipe by examining the target platforms (Linux, Network Devices, Windows).
+1. **Identify Attack Surface**: Determine if the target environment is susceptible to Disk Content Wipe by examining the target platforms (Linux, Network Devices, Windows).
 
-### Assess Existing Defenses
+2. **Assess Existing Defenses**: Review whether mitigations for T1561.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
 
-Review whether mitigations for T1561.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.
+
+> **Note**: No Atomic Red Team tests available for this technique. See [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) for updates.
 
 ## Remediation Guide
 
@@ -108,4 +110,5 @@ Consider implementing IT disaster recovery plans that contain procedures for tak
 - [Novetta Blockbuster Destructive Malware](https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf)
 - [Novetta Blockbuster](https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf)
 - [Microsoft Sysmon v6 May 2017](https://docs.microsoft.com/sysinternals/downloads/sysmon)
+- [Atomic Red Team - T1561.001](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1561.001)
 - [MITRE ATT&CK - T1561.001](https://attack.mitre.org/techniques/T1561/001)

package/skill/mitre_attack/TA0040_impact/T1561.002_disk-structure-wipe/SKILL.md

@@ -72,13 +72,15 @@ To maximize impact on the target organization, malware designed for destroying d
 
 ## How to Test
 
-### Identify Attack Surface
+### Manual Testing
 
-Determine if the target environment is susceptible to Disk Structure Wipe by examining the target platforms (Linux, macOS, Windows).
+1. **Identify Attack Surface**: Determine if the target environment is susceptible to Disk Structure Wipe by examining the target platforms (Linux, macOS, Windows).
 
-### Assess Existing Defenses
+2. **Assess Existing Defenses**: Review whether mitigations for T1561.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
 
-Review whether mitigations for T1561.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.
+
+> **Note**: No Atomic Red Team tests available for this technique. See [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) for updates.
 
 ## Remediation Guide
 
@@ -113,4 +115,5 @@ Consider implementing IT disaster recovery plans that contain procedures for tak
 - [Kaspersky StoneDrill 2017](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf)
 - [Microsoft Sysmon v6 May 2017](https://docs.microsoft.com/sysinternals/downloads/sysmon)
 - [Symantec Shamoon 2012](https://www.symantec.com/connect/blogs/shamoon-attacks)
+- [Atomic Red Team - T1561.002](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1561.002)
 - [MITRE ATT&CK - T1561.002](https://attack.mitre.org/techniques/T1561/002)

package/skill/mitre_attack/TA0040_impact/T1561_disk-wipe/SKILL.md

@@ -67,13 +67,15 @@ On network devices, adversaries may wipe configuration files and other data from
 
 ## How to Test
 
-### Identify Attack Surface
+### Manual Testing
 
-Determine if the target environment is susceptible to Disk Wipe by examining the target platforms (Linux, macOS, Windows).
+1. **Identify Attack Surface**: Determine if the target environment is susceptible to Disk Wipe by examining the target platforms (Linux, macOS, Windows).
 
-### Assess Existing Defenses
+2. **Assess Existing Defenses**: Review whether mitigations for T1561 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
 
-Review whether mitigations for T1561 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.
+
+> **Note**: No Atomic Red Team tests available for this technique. See [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) for updates.
 
 ## Remediation Guide
 
@@ -104,4 +106,5 @@ Consider implementing IT disaster recovery plans that contain procedures for tak
 - [erase_cmd_cisco](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/D_through_E.html#wp3557227463)
 - [Novetta Blockbuster Destructive Malware](https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf)
 - [Microsoft Sysmon v6 May 2017](https://docs.microsoft.com/sysinternals/downloads/sysmon)
+- [Atomic Red Team - T1561](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1561)
 - [MITRE ATT&CK - T1561](https://attack.mitre.org/techniques/T1561)

package/skill/mitre_attack/TA0040_impact/T1565.001_stored-data-manipulation/SKILL.md

@@ -67,13 +67,15 @@ Stored data could include a variety of file formats, such as Office files, datab
 
 ## How to Test
 
-### Identify Attack Surface
+### Manual Testing
 
-Determine if the target environment is susceptible to Stored Data Manipulation by examining the target platforms (Linux, macOS, Windows).
+1. **Identify Attack Surface**: Determine if the target environment is susceptible to Stored Data Manipulation by examining the target platforms (Linux, macOS, Windows).
 
-### Assess Existing Defenses
+2. **Assess Existing Defenses**: Review whether mitigations for T1565.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
 
-Review whether mitigations for T1565.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.
+
+> **Note**: No Atomic Red Team tests available for this technique. See [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) for updates.
 
 ## Remediation Guide
 
@@ -109,4 +111,5 @@ Consider encrypting important information to reduce an adversary’s ability to
 
 - [DOJ Lazarus Sony 2018](https://www.justice.gov/opa/press-release/file/1092091/download)
 - [FireEye APT38 Oct 2018](https://www.mandiant.com/sites/default/files/2021-09/rpt-apt38-2018-web_v5-1.pdf)
+- [Atomic Red Team - T1565.001](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1565.001)
 - [MITRE ATT&CK - T1565.001](https://attack.mitre.org/techniques/T1565/001)

package/skill/mitre_attack/TA0040_impact/T1565.002_transmitted-data-manipulation/SKILL.md

@@ -67,13 +67,15 @@ Manipulation may be possible over a network connection or between system process
 
 ## How to Test
 
-### Identify Attack Surface
+### Manual Testing
 
-Determine if the target environment is susceptible to Transmitted Data Manipulation by examining the target platforms (Linux, macOS, Windows).
+1. **Identify Attack Surface**: Determine if the target environment is susceptible to Transmitted Data Manipulation by examining the target platforms (Linux, macOS, Windows).
 
-### Assess Existing Defenses
+2. **Assess Existing Defenses**: Review whether mitigations for T1565.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
 
-Review whether mitigations for T1565.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.
+
+> **Note**: No Atomic Red Team tests available for this technique. See [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) for updates.
 
 ## Remediation Guide
 
@@ -103,4 +105,5 @@ Encrypt all important data flows to reduce the impact of tailored modifications
 
 - [DOJ Lazarus Sony 2018](https://www.justice.gov/opa/press-release/file/1092091/download)
 - [FireEye APT38 Oct 2018](https://www.mandiant.com/sites/default/files/2021-09/rpt-apt38-2018-web_v5-1.pdf)
+- [Atomic Red Team - T1565.002](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1565.002)
 - [MITRE ATT&CK - T1565.002](https://attack.mitre.org/techniques/T1565/002)

package/skill/mitre_attack/TA0040_impact/T1565.003_runtime-data-manipulation/SKILL.md

@@ -67,13 +67,15 @@ Adversaries may alter application binaries used to display data in order to caus
 
 ## How to Test
 
-### Identify Attack Surface
+### Manual Testing
 
-Determine if the target environment is susceptible to Runtime Data Manipulation by examining the target platforms (Linux, macOS, Windows).
+1. **Identify Attack Surface**: Determine if the target environment is susceptible to Runtime Data Manipulation by examining the target platforms (Linux, macOS, Windows).
 
-### Assess Existing Defenses
+2. **Assess Existing Defenses**: Review whether mitigations for T1565.003 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
 
-Review whether mitigations for T1565.003 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.
+
+> **Note**: No Atomic Red Team tests available for this technique. See [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) for updates.
 
 ## Remediation Guide
 
@@ -106,4 +108,5 @@ Prevent critical business and system processes from being replaced, overwritten,
 
 - [DOJ Lazarus Sony 2018](https://www.justice.gov/opa/press-release/file/1092091/download)
 - [FireEye APT38 Oct 2018](https://www.mandiant.com/sites/default/files/2021-09/rpt-apt38-2018-web_v5-1.pdf)
+- [Atomic Red Team - T1565.003](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1565.003)
 - [MITRE ATT&CK - T1565.003](https://attack.mitre.org/techniques/T1565/003)

package/skill/mitre_attack/TA0040_impact/T1565_data-manipulation/SKILL.md

@@ -64,13 +64,15 @@ The type of modification and the impact it will have depends on the target appli
 
 ## How to Test
 
-### Identify Attack Surface
+### Manual Testing
 
-Determine if the target environment is susceptible to Data Manipulation by examining the target platforms (Linux, macOS, Windows).
+1. **Identify Attack Surface**: Determine if the target environment is susceptible to Data Manipulation by examining the target platforms (Linux, macOS, Windows).
 
-### Assess Existing Defenses
+2. **Assess Existing Defenses**: Review whether mitigations for T1565 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
 
-Review whether mitigations for T1565 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.
+
+> **Note**: No Atomic Red Team tests available for this technique. See [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) for updates.
 
 ## Remediation Guide
 
@@ -108,4 +110,5 @@ Ensure least privilege principles are applied to important information resources
 ## References
 
 - [Sygnia Elephant Beetle Jan 2022](https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf?__hstc=147695848.3e8f1a482c8f8d4531507747318e660b.1680005306711.1680005306711.1680005306711.1&__hssc=147695848.1.1680005306711&__hsfp=3000179024&hsCtaTracking=189ec409-ae2d-4909-8bf1-62dcdd694372%7Cca91d317-8f10-4a38-9f80-367f551ad64d)
+- [Atomic Red Team - T1565](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1565)
 - [MITRE ATT&CK - T1565](https://attack.mitre.org/techniques/T1565)

package/skill/mitre_attack/TA0040_impact/T1657_financial-theft/SKILL.md

@@ -69,13 +69,15 @@ Due to the potentially immense business impact of financial theft, an adversary
 
 ## How to Test
 
-### Identify Attack Surface
+### Manual Testing
 
-Determine if the target environment is susceptible to Financial Theft by examining the target platforms (Linux, macOS, Office Suite).
+1. **Identify Attack Surface**: Determine if the target environment is susceptible to Financial Theft by examining the target platforms (Linux, macOS, Office Suite).
 
-### Assess Existing Defenses
+2. **Assess Existing Defenses**: Review whether mitigations for T1657 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
 
-Review whether mitigations for T1657 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.
+
+> **Note**: No Atomic Red Team tests available for this technique. See [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) for updates.
 
 ## Remediation Guide
 
@@ -117,4 +119,5 @@ Limit access/authority to execute sensitive transactions, and switch to systems
 - [BBC-Ronin](https://www.bbc.com/news/technology-60933174)
 - [wired-pig butchering](https://www.wired.com/story/pig-butchering-fbi-ic3-2022-report/)
 - [NYT-Colonial](https://www.nytimes.com/2021/05/13/technology/colonial-pipeline-ransom.html)
+- [Atomic Red Team - T1657](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1657)
 - [MITRE ATT&CK - T1657](https://attack.mitre.org/techniques/T1657)

package/skill/mitre_attack/TA0040_impact/T1667_email-bombing/SKILL.md

@@ -66,13 +66,15 @@ This behavior may be a precursor for Spearphishing Voice. For example, an advers
 
 ## How to Test
 
-### Identify Attack Surface
+### Manual Testing
 
-Determine if the target environment is susceptible to Email Bombing by examining the target platforms (Linux, Office Suite, Windows).
+1. **Identify Attack Surface**: Determine if the target environment is susceptible to Email Bombing by examining the target platforms (Linux, Office Suite, Windows).
 
-### Assess Existing Defenses
+2. **Assess Existing Defenses**: Review whether mitigations for T1667 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
 
-Review whether mitigations for T1667 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.
+
+> **Note**: No Atomic Red Team tests available for this technique. See [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) for updates.
 
 ## Remediation Guide
 
@@ -107,4 +109,5 @@ Use anti-spoofing and email authentication mechanisms to filter messages based o
 - [sophos-bombing](https://news.sophos.com/en-us/2025/01/21/sophos-mdr-tracks-two-ransomware-campaigns-using-email-bombing-microsoft-teams-vishing/)
 - [rapid7-email-bombing](https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators)
 - [hhs-email-bombing](https://www.hhs.gov/sites/default/files/email-bombing-sector-alert-tlpclear.pdf)
+- [Atomic Red Team - T1667](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1667)
 - [MITRE ATT&CK - T1667](https://attack.mitre.org/techniques/T1667)

package/skill/mitre_attack/TA0042_resource-development/T1583.001_domains/SKILL.md

@@ -72,13 +72,15 @@ In addition to legitimately purchasing a domain, an adversary may register a new
 
 ## How to Test
 
-### Identify Attack Surface
+### Manual Testing
 
-Determine if the target environment is susceptible to Domains by examining the target platforms (PRE).
+1. **Identify Attack Surface**: Determine if the target environment is susceptible to Domains by examining the target platforms (PRE).
 
-### Assess Existing Defenses
+2. **Assess Existing Defenses**: Review whether mitigations for T1583.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
 
-Review whether mitigations for T1583.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
+3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.
+
+> **Note**: No Atomic Red Team tests available for this technique. See [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) for updates.
 
 ## Remediation Guide
 
@@ -120,3 +122,8 @@ Organizations may intentionally register similar domains to their own to deter a
 - [URI](https://www.techtarget.com/searchsecurity/tip/Preparing-for-uniform-resource-identifier-URI-exploits)
 - [Redirectors_Domain_Fronting](https://www.cobaltstrike.com/blog/high-reputation-redirectors-and-domain-fronting/)
 - [URI Use](https://www.blackhat.com/presentations/bh-dc-08/McFeters-Rios-Carter/Presentation/bh-dc-08-mcfeters-rios-carter.pdf)
+- [iOS URL Scheme](https://docs.ostorlab.co/kb/IPA_URL_SCHEME_HIJACKING/index.html)
+- [lazgroup_idn_phishing](https://web.archive.org/web/20171223000420/https://www.riskiq.com/blog/labs/lazarus-group-cryptocurrency/)
+- [httrack_unhcr](https://web.archive.org/web/20220527112908/https://www.riskiq.com/blog/labs/ukraine-malware-infrastructure/)
+- [ThreatConnect Infrastructure Dec 2020](https://threatconnect.com/blog/infrastructure-research-hunting/)
+- [Atomic Red Team - T1583.001](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1583.001)