Atomic Red Team

Prompts and answers

• What type of executor is used for actions that cannot be automated?
  manual
• What is the field in an Atomic YAML file populated by a unique identifier to isolate a specific Atomic?
  auto_generated_guid
• What is the field in an Atomic YAML file populated by commands for deleting files used for emulation or reverting modified configurations?
  cleanup_command
• How many atomic tests are under Atomic T1110.001 that are supported on Windows hosts?
  4
• What is the Atomic name of the second test under Atomic T1218.005?
  Mshta executes VBScript to execute malicious command
• How many prerequisites are not met for Atomic T1003?
  4
• What is the parameter used to execute the specific Atomic test via GUID?
  TestGuids
• What is the name of the scheduled task created after executing the 2nd test of Atomic T1053.005?
  spawn
• What is the registry key modified after executing the 2nd test of Atomic T1547.001?
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend
• Using the ATT&CK Navigator, how many techniques are attributed to admin@338?
  9
• Using the mapping provided by the ATT&CK Navigator, what is the Technique ID of the phishing technique used by the threat group?
  T1566.001
• How many Atomic tests on Atomic T1083 are supported on Windows hosts?
  4
• What file should exist to satisfy the prerequisite of Atomic Test T1049-4?
  Sharpview.exe
• What is the echoed string upon executing Atomic Test T1059.003-3?
  Hello, from CMD!
• What is the hostname of the machine based on Atomic Test T1082-6?
  ATOMIC
• How many accounts are disabled based on Atomic Test T1087.001-9?
  3
• How many Sysmon events are generated after executing Atomic Test T1547.001-4?
  14
• Based on the same events from Q1, what is the file name created by the test?
  vbsstartup.vbs
• Based on the Registry Value Set event generated after executing Atomic Test T1547.001-13, what is the value of the TargetObject field?
  HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\atomictest
• Excluding the WHOAMI detection, what is the title of the first rule triggered on Aurora EDR after executing Atomic Test T1547.001-7?
  PowerShell Writing Startup Shortcuts
• Excluding the WHOAMI detection, what is the title of the first rule triggered on Aurora EDR after executing Atomic Test T1547.001-8?
  Registry Persistence Mechanisms in Recycle Bin
• What parameter should you use to customise the input arguments interactively?
  PromptForInputArgs
• What parameter should you use in conjunction with InputArgs/PromptForInputArgs to revert the changes made by the test?
  Cleanup
• What is the default port used by the Atomic GUI?
  8487
• Using the ATT&CK Navigator, how many techniques are attributed to APT37?
  29
• Using the mapping provided by the ATT&CK Navigator, what is the phishing technique used by the threat group?
  Spearphishing Attachment
• How many techniques attributed to APT37 have an existing Atomic file?
  21
• Based on the results of Q3, which Atomic has no tests supported on Windows?
  T1059.006
• What is the description of the prerequisite needed for Atomic Test T1055-1?
  The 64-bit version of Microsoft Office must be installed
• How many Atomic tests have met the prerequisites for Atomic T1082?
  15
• What are the three event IDs logged based on the execution of Atomic Test 1547.001-3? Provide the IDs in ascending order (e.g. 1,2,3).
  1,11,13
• What command is executed (with default input value) by Atomic Test T1529-1? Do not run without the ShowDetails parameter.
  shutdown /s /t 1
• What is the value of the TargetFilename inside the File Creation log (Event ID 11) generated by Atomic Test T1106-1?
  C:\Users\Administrator\AppData\Local\Temp\2\T1106.exe
• How many events are generated by executing the cleanup actions of Atomic T1105?
  28