Detection telemetry and configuration
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
Cloud Service Modification · source-mapped
DC0069 collection page — Collect the service-specific update API and resulting configuration state; record account/project, actor and changed settings.
Providers and collection configuration
- In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.
- Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.
- Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies.
Required normalized fields: service, resource_id, attribute, before, after.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0069",
"collector": "illustrative-lab-collector",
"observation": {
"service": "lab-audit-service",
"resource_id": "lab-service-1",
"attribute": "retention_days",
"before": 7,
"after": 30
}
}
Visibility limits: AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.
Command Execution · source-mapped
DC0064 collection page — Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.
Providers and collection configuration
- Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.
- Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.
- On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records.
Required normalized fields: interpreter, command_line, actor_uid, session_id.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0064",
"collector": "illustrative-lab-collector",
"observation": {
"interpreter": "/bin/sh",
"command_line": "printf LAB_TELEMETRY_CHECK",
"actor_uid": 1000,
"session_id": "lab-session-1"
}
}
Visibility limits: Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.
Host Status · source-mapped
DC0018 collection page — Collect agent heartbeat and OS health independently; record missed polls, last-seen time and monitor health.
Providers and collection configuration
- osquery: Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.
- Linux Audit plus inventory snapshots: Events explain changes; snapshots describe state at collection time.
- Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.
- Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.
- Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset.
Required normalized fields: asset_id, status, heartbeat_age_seconds, collector_healthy.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0018",
"collector": "illustrative-lab-collector",
"observation": {
"asset_id": "lab-host-1",
"status": "degraded",
"heartbeat_age_seconds": 90,
"collector_healthy": true
}
}
Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.
Process Creation · source-mapped
DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.
Providers and collection configuration
- Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
- Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
- Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.
- On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
- Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
- For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.
Required normalized fields: process_guid, image, parent_image, command_line, user.
<EventFiltering>
<ProcessCreate onmatch="include">
<Image condition="is">C:\Windows\System32\whoami.exe</Image>
</ProcessCreate>
</EventFiltering>
This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0032",
"collector": "illustrative-lab-collector",
"observation": {
"process_guid": "lab-process-001",
"image": "C:\\Windows\\System32\\whoami.exe",
"parent_image": "C:\\Windows\\System32\\cmd.exe",
"command_line": "whoami",
"user": "LAB\\analyst"
}
}
Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
Process Termination · source-mapped
DC0033 collection page — Collect Sysmon ProcessTerminate (5) and join on ProcessGuid; do not assume every provider records an exit code.
Providers and collection configuration
- Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
- Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
- Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.
- On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
- Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
- For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.
Required normalized fields: process_guid, process_id, action.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0033",
"collector": "illustrative-lab-collector",
"observation": {
"process_guid": "lab-process-001",
"process_id": 4200,
"action": "terminate"
}
}
Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
Service Creation · source-mapped
DC0060 collection page — Collect service-install auditing through Audit Security System Extension where supported, plus Service Control Manager/System logs and the new service configuration.
Providers and collection configuration
- Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.
- For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.
- Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*.
Required normalized fields: service, action, executable, actor.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0060",
"collector": "illustrative-lab-collector",
"observation": {
"service": "LabService",
"action": "install",
"executable": "C:\\Lab\\service.exe",
"actor": "lab-admin"
}
}
Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
Service Metadata · source-mapped
DC0041 collection page — Inventory service name, executable, startup mode, owner and status using supported OS APIs; compare successive snapshots.
Providers and collection configuration
- osquery: Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.
- Linux Audit plus inventory snapshots: Events explain changes; snapshots describe state at collection time.
- Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.
- Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.
- Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset.
Required normalized fields: service, executable, start_mode, state.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0041",
"collector": "illustrative-lab-collector",
"observation": {
"service": "LabService",
"executable": "C:\\Lab\\service.exe",
"start_mode": "manual",
"state": "stopped"
}
}
Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.
Service Modification · source-mapped
DC0065 collection page — Collect service manager/configuration audit and snapshot differences, including executable path, service account and start mode.
Providers and collection configuration
- Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.
- For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.
- Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*.
Required normalized fields: service, attribute, before, after.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0065",
"collector": "illustrative-lab-collector",
"observation": {
"service": "LabService",
"attribute": "start_mode",
"before": "manual",
"after": "automatic"
}
}
Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
Windows Registry Key Modification · source-mapped
DC0063 collection page — Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.
Providers and collection configuration
- Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
- On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
- Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
- Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence.
Required normalized fields: registry_path, event_type, value_type, value.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0063",
"collector": "illustrative-lab-collector",
"observation": {
"registry_path": "HKCU\\Software\\Lab\\Mode",
"event_type": "SetValue",
"value_type": "DWORD",
"value": 1
}
}
Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
Simulation design and documented procedures
Atomic evidence: 77 compatible documented candidates. Live lab status: not run for these imported procedures.
Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.
Disable OpenDNS Umbrella
Disables OpenDNS Umbrella
Pinned Atomic procedure · 07f43b33-1e15-4e99-be70-bc094157c849 · macos · sh.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
ESXi - Disable Account Lockout Policy via PowerCLI
An adversary may disable account lockout policy within ESXi to have the ability to prevent defensive actions from being enforced in the future or to prevent future alerting.
Pinned Atomic procedure · 091a6290-cd29-41cb-81ea-b12f133c66cb · linux · powershell.
Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.
vm_host: Specify the host name of the ESXi Server (type string; source default atomic.local)vm_user: Specify the privilege user account on ESXi Server (type string; source default root)vm_pass: Specify the privilege user password on ESXi Server (type string; source default pass)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- Check if VMWARE PowerCLI PowerShell Module is installed.
Tamper with Windows Defender Evade Scanning -Folder
Malware can exclude a specific path from being scanned and evading detection.
Upon successul execution, the file provided should be on the list of excluded path.
To check the exclusion list using poweshell (Get-MpPreference).ExclusionPath
Pinned Atomic procedure · 0b19f4ee-de90-4059-88cb-63c800c683ed · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
excluded_folder: This folder will be excluded from scanning (type path; source default C:\Temp)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Delete Microsoft Defender ASR Rules - GPO
This test simulates the deletion of the ASR rules loaded by Microsoft Defender using the registry. Depending on the deployment, rules can be pushed either using GPO or InTune, This test simulates a GPO-based rules deployment.
Pinned Atomic procedure · 0e7b8a4b-2ca5-4743-a9f9-96051abb6e50 · windows · powershell.
Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable .NET Event Tracing for Windows Via Environment Variable HKLM Registry - Cmd
Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKLM registry using the reg.exe utility. In order for changes to take effect a reboot might be required.
Pinned Atomic procedure · 110b4281-43fe-405f-a184-5d8eaf228ebf · windows · command_prompt.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Block Cybersecurity communication by leveraging Windows Name Resolution Policy Table
Adversaries are redirecting DNS queries to an incorrect or malicious DNS server IP, thereby blocking legitimate communications and potentially compromising the security infrastructure. This atomic test aims to respond with 127.0.0.1 when a DNS query is made for endpoint.security.microsoft.com.
Pinned Atomic procedure · 1174b5df-2c33-490f-8854-f5eb80c907ca · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
AWS - GuardDuty Suspension or Deletion
Enables GuardDuty in AWS, upon successful creation this test will suspend and then delete the GuardDuty configuration.
Pinned Atomic procedure · 11e65d8d-e7e4-470e-a3ff-82bc56ad938e · iaas:aws · bash.
Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
region: Name of the specified region (type string; source default us-east-1)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- Check if ~/.aws/credentials file has a default stanza is configured
Disable journal logging via sed utility
The atomic test disables the journal logging by searching and replacing the "Storage" parameter to "none" within the journald.conf file, thus any new journal entries will only be temporarily available in memory and not written to disk
Pinned Atomic procedure · 12e5551c-8d5c-408e-b3e4-63f53b03379f · linux · sh.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
AMSI Bypass - Remove AMSI Provider Reg Key
With administrative rights, an adversary can remove the AMSI Provider registry key in HKLM\Software\Microsoft\AMSI to disable AMSI inspection.
This test removes the Windows Defender provider registry key. Upon execution, no output is displayed.
Open Registry Editor and navigate to "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\" to verify that it is gone.
Pinned Atomic procedure · 13f09b91-c953-438e-845b-b585e51cac9b · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
AMSI Bypass - Override AMSI via COM
With administrative rights, an adversary can disable AMSI via registry value in HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} by overriding the Microsoft Defender COM object for AMSI and points it to a DLL that does not exist.
This is currently being used by AsyncRAT and others.
https://strontic.github.io/xcyclopedia/library/clsid_fdb00e52-a214-4aa1-8fba-4357bb0072ec.html
https://securitynews.sonicwall.com/xmlpost/asyncrat-variant-includes-cryptostealer-capabilites/
Pinned Atomic procedure · 17538258-5699-4ff1-92d1-5ac9b0dc21f5 · windows · command_prompt.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable .NET Event Tracing for Windows Via Registry (powershell)
Disables ETW for the .NET Framework using PowerShell to update the Windows registry
Pinned Atomic procedure · 19c07a45-452d-4620-90ed-4c34fffbe758 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Tamper with Windows Defender Registry
Disable Windows Defender from starting after a reboot. Upen execution, if the computer is rebooted the entire Virus and Threat protection window in Settings will be
grayed out and have no info.
Pinned Atomic procedure · 1b3e0146-a1e5-4c5c-89fb-1bb2ffe8fc45 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable EventLog-Application ETW Provider Via Registry - Cmd
This atomic simulates an activity where an attacker disables a specific ETW provider from the EventLog-Application ETW Auto Logger session using the reg.exe utility to update the Windows registry value "Enabled". This would effectivly remove that provider from the session and cause to not emit any logs of that type. The changes would only take effect after a restart.
Pinned Atomic procedure · 1cac9b54-810e-495c-8aac-989e0076583b · windows · command_prompt.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
ETWProviderGUID: Microsoft-Windows-SenseIR ETW Provider GUID (type string; source default {B6D775EF-1436-4FE6-BAD3-9E436319E218})
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Tamper with Windows Defender Registry - Reg.exe
Disable Windows Defender by tampering with windows defender registry using the utility "reg.exe"
Pinned Atomic procedure · 1f6743da-6ecc-4a93-b03f-dc357e4b313f · windows · command_prompt.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Auditing Configuration Changes on Linux Host
Emulates modification of auditd configuration files
Pinned Atomic procedure · 212cfbcf-4770-4980-bc21-303e37abd0e3 · linux · bash.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
audisp_config_file_name: The name of the audispd configuration file to be changed (type string; source default audispd.conf)auditd_config_file_name: The name of the auditd configuration file to be changed (type string; source default auditd.conf)libaudit_config_file_name: The name of the libaudit configuration file to be changed (type string; source default libaudit.conf)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Clear History
Clear Shell History. This technique only affect the bash shell application.
Pinned Atomic procedure · 23b88394-091b-4968-a42d-fb8076992443 · linux · sh.
Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Kill antimalware protected processes using Backstab
Backstab loads Process Explorer driver which is signed by Microsoft and use it to terminate running processes protected by antimalware software such as MsSense.exe or MsMpEng.exe, which is otherwise not possible to kill.
https://github.com/Yaxser/Backstab
Pinned Atomic procedure · 24a12b91-05a7-4deb-8d7f-035fa98591bc · windows · powershell.
Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.
process_name: Name of the protected process you want to kill/terminate. (type string; source default MsMpEng.exe)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- Backstab64.exe should exist in ExtrnalPayloads Directory
Disable macOS Gatekeeper
Disables macOS Gatekeeper
Pinned Atomic procedure · 2a821573-fb3f-4e71-92c3-daac7432f053 · macos · sh.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Tamper with Windows Defender Evade Scanning -Extension
Malware can exclude specific extensions from being scanned and evading detection.
Upon successful execution, the extension(s) should be on the list of excluded extensions.
To check the exclusion list using poweshell (Get-MpPreference).ExclusionExtension.
Pinned Atomic procedure · 315f4be6-2240-4552-b3e1-d1047f5eecea · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
excluded_exts: A list of extension to exclude from scanning (type string; source default .exe)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Remove Windows Defender Definition Files
Removing definition files would cause ATP to not fire for AntiMalware. Check MpCmdRun.exe man page for info on all arguments.
On later viersions of windows (1909+) this command fails even with admin due to inusfficient privelages. On older versions of windows the
command will say completed.
https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/
Pinned Atomic procedure · 3d47daaa-2f56-43e0-94cc-caf5d8d52a68 · windows · command_prompt.
Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Tamper with Defender ATP on Linux/MacOS
With root privileges, an adversary can disable real time protection. Note, this test assumes Defender is not in passive mode and real-time protection is enabled. The use of a managed.json on Linux or Defender .plist on MacOS will prevent these changes. Tamper protection will also prevent this (available on MacOS, but not Linux at the time of writing). Installation of MDATP is a prerequisite. Installation steps vary across MacOS and Linux distros. See Microsoft public documentation for instructions: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-install-manually?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/linux-install-manually?view=o365-worldwide
Pinned Atomic procedure · 40074085-dbc8-492b-90a3-11bcfc52fda8 · linux, macos · sh.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Windows Disable LSA Protection
The following Atomic adds a registry entry to disable LSA Protection.
The LSA controls and manages user rights information, password hashes and other important bits of information in memory. Attacker tools, such as mimikatz, rely on accessing this content to scrape password hashes or clear-text passwords. Enabling LSA Protection configures Windows to control the information stored in memory in a more secure fashion - specifically, to prevent non-protected processes from accessing that data.
Upon successful execution, the registry will be modified and RunAsPPL will be set to 0, disabling Lsass protection.
https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection#how-to-disable-lsa-protection
https://blog.netwrix.com/2022/01/11/understanding-lsa-protection/
https://thedfirreport.com/2022/03/21/phosphorus-automates-initial-access-using-proxyshell/
Pinned Atomic procedure · 40075d5f-3a70-4c66-9125-f72bee87247d · windows · command_prompt.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Delete Windows Defender Scheduled Tasks
The following atomic test will delete the Windows Defender scheduled tasks.
Reference
Pinned Atomic procedure · 4b841aa1-0d05-4b32-bbe7-7564346e7c76 · windows · command_prompt.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- The Windows Defender scheduled tasks must be backed up first
Disable syslog
Disables syslog collection
Pinned Atomic procedure · 4ce786f8-e601-44b5-bfae-9ebb15a7d1c8 · linux · sh.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
package_checker: Package checking command for linux. (type string; source default (rpm -q rsyslog 2>&1 >/dev/null) || (dpkg -s rsyslog | grep -q installed))package_installer: Package installer command for linux. Default yum (type string; source default (which yum && yum -y install epel-release rsyslog)||(which apt-get && apt-get install -y rsyslog))flavor_command: Command to disable syslog collection. Default newer rsyslog commands. i.e older command = service rsyslog stop ; chkconfig off rsyslog (type string; source default systemctl stop rsyslog ; systemctl disable rsyslog)cleanup_command: Command to enable syslog collection. Default newer rsyslog commands. i.e older command = service rsyslog start ; chkconfig rsyslog on (type string; source default systemctl start rsyslog ; systemctl enable rsyslog)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- Package with rsyslog must be on system
Disable .NET Event Tracing for Windows Via Environment Variable HKLM Registry - PowerShell
Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKLM registry using PowerShell. In order for changes to take effect a reboot might be required.
Pinned Atomic procedure · 4d61779d-be7f-425c-b560-0cafb2522911 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
WMIC Tamper with Windows Defender Evade Scanning Folder
The following Atomic will attempt to exclude a folder within Defender leveraging WMI
Reference: https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/
Pinned Atomic procedure · 59d386fc-3a4b-41b8-850d-9e3eee24dfe4 · windows · command_prompt.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Lockbit Black - Use Registry Editor to turn on automatic logon -Powershell
Lockbit Black - Use Registry Editor to turn on automatic logon
Pinned Atomic procedure · 5e27f36d-5132-4537-b43b-413b0d5eec9a · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable LittleSnitch
Disables LittleSnitch
Pinned Atomic procedure · 62155dd8-bb3d-4f32-b31c-6532ff3ac6a3 · macos · sh.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable EventLog-Application Auto Logger Session Via Registry - Cmd
This atomic simulates an activity where an attacker disables the EventLog-Application ETW Auto Logger session using the reg.exe utility to update the Windows registry value "Start". This would effectivly disable the Event log application channel. The changes would only take effect after a restart.
Pinned Atomic procedure · 653c6e17-14a2-4849-851d-f1c0cc8ea9ab · windows · command_prompt.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
AMSI Bypass - AMSI InitFailed
Any easy way to bypass AMSI inspection is it patch the dll in memory setting the "amsiInitFailed" function to true.
Upon execution, no output is displayed.
https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/
Pinned Atomic procedure · 695eed40-e949-40e5-b306-b4031e4154bd · windows · powershell.
Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
LockBit Black - Disable the ETW Provider of Windows Defender -Powershell
An adversary can disable the ETW Provider of Windows Defender,
so nothing would be logged to Microsoft-Windows-Windows-Defender/Operational anymore.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a
Pinned Atomic procedure · 69fc085b-5444-4879-8002-b24c8e1a3e02 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Logging Configuration Changes on FreeBSD Host
Emulates modification of syslog configuration.
Pinned Atomic procedure · 6b8ca3ab-5980-4321-80c3-bcd77c8daed8 · linux · sh.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
syslog_config_file_name: The name of the syslog configuration file to be changed (type string; source default syslog.conf)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Tamper with Windows Defender ATP PowerShell
Attempting to disable scheduled scanning and other parts of windows defender atp. Upon execution Virus and Threat Protection will show as disabled
in Windows settings.
Pinned Atomic procedure · 6b8df440-51ec-4d53-bf83-899591c9b5d7 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Reboot Linux Host via Kernel System Request
reboot system via system request seen in Awfulshred wiper.
Pinned Atomic procedure · 6d6d3154-1a52-4d1a-9d51-92ab8148b32e · linux · sh.
Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable Powershell ETW Provider - Windows
This test was created to disable the Microsoft Powershell ETW provider by using the built-in Windows tool, logman.exe. This provider is used as a common source of telemetry in AV/EDR solutions.
Pinned Atomic procedure · 6f118276-121d-4c09-bb58-a8fb4a72ee84 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
ps_exec_location: Location of PSExec. (type string; source default PathToAtomicsFolder\..\ExternalPayloads\pstools\PsExec.exe)session: The session to disable. (type string; source default EventLog-Application)provider: The provider to disable. (type string; source default Microsoft-Windows-Powershell)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- PSExec must be installed on the machine.
Disable Microsoft Office Security Features
Gorgon group may disable Office security features so that their code can run. Upon execution, an external document will not
show any warning before editing the document.
https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/
Pinned Atomic procedure · 6f5fb61b-4e56-4a3d-a8c3-82e13686c6d7 · windows · powershell.
Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable Hypervisor-Enforced Code Integrity (HVCI)
This test disables Hypervisor-Enforced Code Integrity (HVCI) by setting the registry key HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity "Enabled" value to "0".
The pre-req needs to be ran in order to setup HVCI and have it enabled.
We do not recommend running this in production.
Black Lotus Campaign
Microsoft
Pinned Atomic procedure · 70bd71e6-eba4-4e00-92f7-617911dbe020 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
AMSI Bypass - Create AMSIEnable Reg Key
Threat Actor could disable the AMSI function by adding a registry value name “AmsiEnable” to the registry key “HKCU\Software\Microsoft\Windows Script\Settings\AmsiEnable” and set its value to 0.
Ref: https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d
Pinned Atomic procedure · 728eca7b-0444-4f6f-ac36-437e3d751dc0 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
WinPwn - Kill the event log services for stealth
Kill the event log services for stealth via function of WinPwn
Pinned Atomic procedure · 7869d7a3-3a30-4d2c-a5d2-f1cd9c34ce66 · windows · powershell.
Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Logging Configuration Changes on Linux Host
Emulates modification of syslog configuration.
Pinned Atomic procedure · 7d40bc58-94c7-4fbb-88d9-ebce9fcdb60c · linux · bash.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
syslog_config_file_name: The name of the syslog configuration file to be changed (type string; source default syslog.conf)rsyslog_config_file_name: The name of the rsyslog configuration file to be changed (type string; source default rsyslog.conf)syslog_ng_config_file_name: The name of the syslog-ng configuration file to be changed (type string; source default syslog-ng.conf)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Throttle Cybersecurity Agent Network Traffic via QoS Policy
This test simulates an adversary impairing security agent capabilities by applying Policy-Based Quality of Service (QoS) throttling rules to security agent processes.
Unlike traditional evasion techniques (such as firewall-based blocking or process termination), this approach leverages native Windows functionality to degrade, rather than disable, defensive tooling:
- Uses built-in Windows QoS features to manipulate application bandwidth
- Limits network throughput to extremely low levels (e.g., 8 bits per second)
- Causes security agents to repeatedly time out when attempting to communicate with their cloud backend
As a result, telemetry ingestion, alerting, and remote response capabilities may be significantly degraded, while the agent itself continues to run and appear operational.
This technique is inspired by research from Zero Salarium and the associated EDRChoker tool (https://www.zerosalarium.com/2026/06/edrchoker-choking-telemetry-stream-block-edr.html), which demonstrates how adversaries can exploit the reliance of modern EDR solutions on persistent, low-latency cloud connectivity to create a temporary loss of visibility without triggering traditional tampering detections.
Pinned Atomic procedure · 7dd05b3e-0803-4852-9345-c494eb3e40fe · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
process_name: Name of the process to throttle (type string; source default MsSense.exe)throttle_rate: Bandwidth limit in bits per second (type integer; source default 8)net_qos_policy_name: Name of the Network QoS Policy to create then delete (type string; source default CyberSecurityAgentThrottlingTest)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- Ensure PowerShell QoS cmdlets are available
Unload Sysmon Filter Driver
Unloads the Sysinternals Sysmon filter driver without stopping the Sysmon service. To verify successful execution,
run the prereq_command's and it should fail with an error of "sysmon filter must be loaded".
Pinned Atomic procedure · 811b3e76-c41b-430c-ac0d-e2380bfaa164 · windows · command_prompt.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
sysmon_driver: The name of the Sysmon filter driver (this can change from the default) (type string; source default SysmonDrv)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
3 prerequisite definitions:
- Sysmon must be downloaded
- sysmon must be Installed
- sysmon filter must be loaded
Disable Defender Using NirSoft AdvancedRun
Information on NirSoft AdvancedRun and its creators found here: http://www.nirsoft.net/utils/advanced_run.html
This Atomic will run AdvancedRun.exe with similar behavior identified during the WhisperGate campaign.
See https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
Upon successful execution, AdvancedRun.exe will attempt to run and stop Defender, and optionally attempt to delete the Defender folder on disk.
Pinned Atomic procedure · 81ce22fd-9612-4154-918e-8a1f285d214d · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
AdvancedRun_Location: Path of Advanced Run executable (type path; source default PathToAtomicsFolder\..\ExternalPayloads\AdvancedRun.exe)delete_defender_folder: Set to 1 to also delete the Windows Defender folder (type integer; source default 0)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- Advancedrun.exe must exist at #{AdvancedRun_Location}
Stop Crowdstrike Falcon on Linux
Stop and disable Crowdstrike Falcon on Linux
Pinned Atomic procedure · 828a1278-81cc-4802-96ab-188bf29ca77d · linux · sh.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable Windows Defender with DISM
The following Atomic will attempt to disable Windows-Defender using the built in DISM.exe, Deployment Image Servicing and Management tool.
DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images.
A successful execution will not standard-out any details. Remove the quiet switch if verbosity is needed.
This method will remove Defender and it's package.
Pinned Atomic procedure · 871438ac-7d6e-432a-b27d-3e7db69faf58 · windows · command_prompt.
Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable .NET Event Tracing for Windows Via Registry (cmd)
Disables ETW for the .NET Framework using the reg.exe utility to update the Windows registry
Pinned Atomic procedure · 8a4c33be-a0d3-434a-bee6-315405edbd5b · windows · command_prompt.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable EventLog-Application ETW Provider Via Registry - PowerShell
This atomic simulates an activity where an attacker disables a specific ETW provider from the EventLog-Application ETW Auto Logger session using the powershell.exe "New-ItemProperty" cmdlet to update the Windows registry value "Enabled". This would effectivly remove that provider from the session and cause to not emit any logs of that type. The changes would only take effect after a restart.
Pinned Atomic procedure · 8f907648-1ebf-4276-b0f0-e2678ca474f0 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
ETWProviderGUID: Microsoft-Windows-SenseIR ETW Provider GUID (type string; source default {B6D775EF-1436-4FE6-BAD3-9E436319E218})
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable Carbon Black Response
Disables Carbon Black Response
Pinned Atomic procedure · 8fba7766-2d11-4b4a-979a-1e3d9cc9a88c · macos · sh.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Suspend History
suspend Shell History seen in Awfulshred wiper- https://unix.stackexchange.com/questions/10922/temporarily-suspend-bash-history-on-a-given-shell
Pinned Atomic procedure · 94f6a1c9-aae7-46a4-9083-2bb1f5768ec4 · linux · sh.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
LockBit Black - Use Registry Editor to turn on automatic logon -cmd
LockBit Black - Use Registry Editor to turn on automatic logon
Pinned Atomic procedure · 9719d0e1-4fe0-4b2e-9a72-7ad3ee8ddc70 · windows · command_prompt.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable Arbitrary Security Windows Service
With administrative rights, an adversary can disable Windows Services related to security products. This test requires McAfeeDLPAgentService to be installed.
Change the service_name input argument for your AV solution. Upon exeuction, infomration will be displayed stating the status of the service.
To verify that the service has stopped, run "sc query McAfeeDLPAgentService"
Pinned Atomic procedure · a1230893-56ac-4c81-b644-2108e982f8f5 · windows · command_prompt.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
service_name: The name of the service to stop (type string; source default McAfeeDLPAgentService)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Tamper with Windows Defender Evade Scanning -Process
Malware can exclude specific processes from being scanned and evading detection.
Upon successful execution, the process(es) should be on the list of excluded processes.
To check the exclusion list using poweshell (Get-MpPreference).ExclusionProcess."
Pinned Atomic procedure · a123ce6a-3916-45d6-ba9c-7d4081315c27 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
excluded_process: A list of processes to exclude from scanning (type string; source default outlook.exe)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Uninstall Sysmon
Uninstall Sysinternals Sysmon for Defense Evasion
Pinned Atomic procedure · a316fb2e-5344-470d-91c1-23e15c374edc · windows · command_prompt.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
sysmon_exe: The location of the Sysmon executable from Sysinternals (ignored if sysmon.exe is found in your PATH) (type path; source default PathToAtomicsFolder\T1685\bin\sysmon.exe)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
2 prerequisite definitions:
- Sysmon executable must be available
- Sysmon must be installed
Tamper with Windows Defender Registry - Powershell
Disable Windows Defender by tampering with windows defender registry through powershell
Pinned Atomic procedure · a72cfef8-d252-48b3-b292-635d332625c3 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Tamper with Windows Defender Command Prompt
Attempting to disable scheduled scanning and other parts of windows defender atp. These commands must be run as System, so they still fail as administrator.
However, adversaries do attempt to perform this action so monitoring for these command lines can help alert to other bad things going on. Upon execution, "Access Denied"
will be displayed twice and the WinDefend service status will be displayed.
Pinned Atomic procedure · aa875ed4-8935-47e2-b2c5-6ec00ab220d2 · windows · command_prompt.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable ASLR Via sysctl parameters - Linux
Detects Execution of the `sysctl` command to set `kernel.randomize_va_space=0` which disables Address Space Layout Randomization (ASLR) in Linux.
Pinned Atomic procedure · ac333fe1-ce2b-400b-a117-538634427439 · linux · bash.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Stop and Remove Arbitrary Security Windows Service
Beginning with Powershell 6.0, the Stop-Service cmdlet sends a stop message to the Windows Service Controller for each of the specified services. The Remove-Service cmdlet removes a Windows service in the registry and in the service database.
Pinned Atomic procedure · ae753dda-0f15-4af6-a168-b9ba16143143 · windows · powershell.
Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.
service_name: The name of the service to remove (type string; source default McAfeeDLPAgentService)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable Cb Response
Disable the Cb Response service
Pinned Atomic procedure · ae8943f7-0f8d-44de-962d-fbc2e2f03eb8 · linux · sh.
Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Uninstall Crowdstrike Falcon on Windows
Uninstall Crowdstrike Falcon. If the WindowsSensor.exe path is not provided as an argument we need to search for it. Since the executable is located in a folder named with a random guid we need to identify it before invoking the uninstaller.
Pinned Atomic procedure · b32b1ccf-f7c1-49bc-9ddd-7d7466a7b297 · windows · powershell.
Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.
falcond_path: The Crowdstrike Windows Sensor path. The Guid always changes. (type path; source default C:\ProgramData\Package Cache\{7489ba93-b668-447f-8401-7e57a6fe538d}\WindowsSensor.exe)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Stop and unload Crowdstrike Falcon on macOS
Stop and unload Crowdstrike Falcon daemons falcond and userdaemon on macOS
Pinned Atomic procedure · b3e7510c-2d4c-4249-a33f-591a2bc83eef · macos · sh.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
falcond_plist: The path of the Crowdstrike Falcon plist file (type path; source default /Library/LaunchDaemons/com.crowdstrike.falcond.plist)userdaemon_plist: The path of the Crowdstrike Userdaemon plist file (type path; source default /Library/LaunchDaemons/com.crowdstrike.userdaemon.plist)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable .NET Event Tracing for Windows Via Environment Variable HKCU Registry - PowerShell
Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKCU registry using PowerShell. In order for changes to take effect a logout might be required.
Pinned Atomic procedure · b42c1f8c-399b-47ae-8fd8-763181395fee · windows · powershell.
Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable journal logging via systemctl utility
The atomic test disables the journal logging using built-in systemctl utility
Pinned Atomic procedure · c3a377f9-1203-4454-aa35-9d391d34768f · linux · sh.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Tamper with Windows Defender ATP using Aliases - PowerShell
Attempting to disable scheduled scanning and other parts of Windows Defender ATP using set-MpPreference aliases. Upon execution Virus and Threat Protection will show as disabled
in Windows settings.
Pinned Atomic procedure · c531aa6e-9c97-4b29-afee-9b7be6fc8a64 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Freeze PPL-protected process with EDR-Freeze
This test utilizes the tool EDR-Freeze, which leverages the native Microsoft binary WerFaultSecure.exe to suspend processes protected by the Protected Process Light mechanism. PPL is a Windows security feature designed to safeguard critical system processes — such as those related to antivirus, credential protection, and system integrity — from tampering or inspection. These processes operate in a restricted environment that prevents access even from administrators or debugging tools, unless the accessing tool is signed and trusted by Microsoft. By using WerFaultSecure.exe, which is inherently trusted by the operating system, EDR-Freeze is able to bypass these restrictions and temporarily freeze PPL-protected processes for analysis or testing purposes.
Pinned Atomic procedure · cbb2573a-a6ad-4c87-aef8-6e175598559b · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
processName: PPL-protected process name to target (type string; source default SecurityHealthService)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Auditing Configuration Changes on FreeBSD Host
Emulates modification of auditd configuration files
Pinned Atomic procedure · cedaf7e7-28ee-42ab-ba13-456abd35d1bd · linux · sh.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
auditd_config_file_name: The name of the auditd configuration file to be changed (type string; source default audit_event)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
LockBit Black - Disable Privacy Settings Experience Using Registry -cmd
LockBit Black - Disable Privacy Settings Experience Using Registry
Pinned Atomic procedure · d6d22332-d07d-498f-aea0-6139ecb7850e · windows · command_prompt.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
LockBit Black - Disable Privacy Settings Experience Using Registry -Powershell
LockBit Black - Disable Privacy Settings Experience Using Registry
Pinned Atomic procedure · d8c57eaa-497a-4a08-961e-bd5efd7c9374 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable EventLog-Application Auto Logger Session Via Registry - PowerShell
This atomic simulates an activity where an attacker disables the EventLog-Application ETW Auto Logger session using the powershell.exe "New-ItemProperty" cmdlet to update the Windows registry value "Start". This would effectivly disable the Event log application channel. The changes would only take effect after a restart.
Pinned Atomic procedure · da86f239-9bd3-4e85-92ed-4a94ef111a1c · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable syslog (freebsd)
Disables syslog collection
Pinned Atomic procedure · db9de996-441e-4ae0-947b-61b6871e2fdf · linux · sh.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable Memory Swap
disable swapping of device paging that impaire the compromised host to swap data if the RAM is full. Awfulshred wiper used this technique as an additional
payload to the compromised host and to make sure that there will be no recoverable data due to swap feature of FreeBSD/linux.
Pinned Atomic procedure · e74e4c63-6fde-4ad2-9ee8-21c3a1733114 · linux · sh.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Delete Microsoft Defender ASR Rules - InTune
This test simulates the deletion of the ASR rules loaded by Microsoft Defender using the registry. Depending on the deployment, rules can be pushed either using GPO or InTune, This test simulates an InTune-based rules deployment.
Pinned Atomic procedure · eea0a6c2-84e9-4e8c-a242-ac585d28d0d1 · windows · powershell.
Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable Windows Defender with PwSh Disable-WindowsOptionalFeature
The following Atomic will attempt to disable Windows-Defender using the built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool.
Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images.
A successful execution will not standard-out any details. Remove the quiet switch if verbosity is needed.
This method will remove Defender and it's packages.
Reference: https://docs.microsoft.com/en-us/powershell/module/dism/disable-windowsoptionalfeature?view=windowsserver2022-ps
Pinned Atomic procedure · f542ffd3-37b4-4528-837f-682874faa012 · windows · powershell.
Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
LockBit Black - Disable the ETW Provider of Windows Defender -cmd
An adversary can disable the ETW Provider of Windows Defender,
so nothing would be logged to Microsoft-Windows-Windows-Defender/Operational anymore.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a
Pinned Atomic procedure · f6df0b8e-2c83-44c7-ba5e-0fa4386bec41 · windows · command_prompt.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Clear Pagging Cache
clear pagging cache via system request. This is a temporary change in the system to clear paging cache. This technique seen in Awfulshred wiper as part
of its malicious payload on the compromised host. added reference link for this technique: https://www.tecmint.com/clear-ram-memory-cache-buffer-and-swap-space-on-linux/
Pinned Atomic procedure · f790927b-ea85-4a16-b7b2-7eb44176a510 · linux · sh.
Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Disable SELinux
Disables SELinux enforcement
Pinned Atomic procedure · fc225f36-9279-4c39-b3f9-5141ab74f8d8 · linux · sh.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- SELinux must be installed
Disable .NET Event Tracing for Windows Via Environment Variable HKCU Registry - Cmd
Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKCU registry using the reg.exe utility. In order for changes to take effect a logout might be required.
Pinned Atomic procedure · fdac1f79-b833-4bab-b4a1-11b1ed676a4b · windows · command_prompt.
Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
AMSI Bypass - Patching AmsiScanBuffer
Patches AmsiScanBuffer in memory using P/Invoke to resolve the function address via
GetModuleHandle/GetProcAddress, then overwrites the prologue with instructions that
return AMSI_RESULT_CLEAN immediately (mov al, 1; ret).
Reference: https://i.blackhat.com/briefings/asia/2018/asia-18-Tal-Liberman-Documenting-the-Undocumented-The-Rise-and-Fall-of-AMSI.pdf
Pinned Atomic procedure · ff543dd9-4537-458c-b297-c85ae1939e34 · windows · powershell.
Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Technique-specific experiment contract
- Choose one procedure implementing T1685 Disable or Modify Tools; identify the observable behavior in the source definition, not just its tactic.
- Record exact target, tool/version, inputs, privileges, network limits and approval. Never run an imported default target automatically.
- Enable the collection sources above and verify a benign baseline reaches the detector.
- Run only the approved isolated scenario; capture native events and an independent behavior observable.
- Evaluate the exact rule/model, restore the lab, and preserve configuration, event hashes, alerts, controls and misses.