Initial commit

.gitignore

@@ -0,0 +1,4 @@
+.devcontainer
+
+bin/
+bindata.go

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 Bryan Richardson
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Makefile

@@ -0,0 +1,45 @@
+SHELL := /bin/bash
+
+# Default hyperdark version number to the shorthand git commit hash if
+# not set at the command line.
+VER     := $(or $(VER),$(shell git log -1 --format="%h"))
+COMMIT  := $(shell git log -1 --format="%h - %ae")
+DATE    := $(shell date -u)
+VERSION := $(VER) (commit $(COMMIT)) $(DATE)
+
+GOSOURCES := $(shell find . \( -name '*.go' \))
+INCLUDES  := $(shell find includes \( -name '*' \))
+
+THISFILE := $(lastword $(MAKEFILE_LIST))
+THISDIR  := $(shell dirname $(realpath $(THISFILE)))
+GOBIN    := $(THISDIR)/bin
+
+# Prepend this repo's bin directory to our path since we'll want to
+# install some build tools there for use during the build process.
+PATH := $(GOBIN):$(PATH)
+
+# Export GOBIN env variable so `go install` picks it up correctly.
+export GOBIN
+
+all:
+
+clean:
+	-rm bin/atomicredteam
+	-rm bindata.go
+
+.PHONY: install-build-deps
+install-build-deps: bin/go-bindata
+
+.PHONY: remove-build-deps
+remove-build-deps:
+	$(RM) bin/go-bindata
+
+bin/go-bindata:
+	go install github.com/go-bindata/go-bindata/v3/go-bindata
+
+bindata.go: $(INCLUDES) bin/go-bindata
+	$(GOBIN)/go-bindata -pkg atomicredteam -prefix include -o bindata.go include/...
+
+bin/atomicredteam: $(GOSOURCES) bindata.go
+	mkdir -p bin
+	CGO_ENABLED=0 GOOS=linux go build -a -ldflags="-X 'actshad.dev/go-atomicredteam.Version=$(VERSION)' -s -w" -trimpath -o bin/atomicredteam cmd/main.go

README.md

@@ -0,0 +1,19 @@
+go-atomicredteam is a Golang application to execute tests as defined in the
+atomics folder of Red Canary's Atomic Red Team project. The "atomics folder"
+contains a folder for each Technique defined by the MITRE ATT&CK™ Framework.
+Inside of each of these "T#" folders you'll find a yaml file that defines the
+attack procedures for each atomic test as well as an easier to read markdown
+(md) version of the same data.
+
+* Executing atomic tests may leave your system in an undesirable state. You are
+  responsible for understanding what a test does before executing.
+
+* Ensure you have permission to test before you begin.
+
+* It is recommended to set up a test machine for atomic test execution that is
+  similar to the build in your environment. Be sure you have your
+  collection/EDR solution in place, and that the endpoint is checking in and
+  active.
+
+Note: This execution framwork works on Windows, MacOS, and Linux (assuming
+it's cross-compiled).

cmd/main.go

@@ -0,0 +1,77 @@
+package main
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"strings"
+	"time"
+
+	"actshad.dev/go-atomicredteam"
+
+	"github.com/urfave/cli/v2"
+	"gopkg.in/yaml.v3"
+)
+
+func main() {
+	app := &cli.App{
+		Name:    "atomicredteam",
+		Version: atomicredteam.Version,
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:    "technique",
+				Aliases: []string{"t"},
+				Usage:   "technique ID",
+			},
+			&cli.StringFlag{
+				Name:    "name",
+				Aliases: []string{"n"},
+				Usage:   "test name",
+			},
+			&cli.StringFlag{
+				Name:    "repo",
+				Aliases: []string{"r"},
+				Value:   "redcanaryco/master",
+				Usage:   "Atomic Red Team repo/branch name",
+			},
+			&cli.StringSliceFlag{
+				Name:  "input",
+				Usage: "input key=value pairs",
+			},
+		},
+		Action: func(ctx *cli.Context) error {
+			tid := ctx.String("technique")
+
+			if tid == "" {
+				return cli.Exit("no technique provided", 1)
+			}
+
+			name := ctx.String("name")
+
+			if name == "" {
+				return cli.Exit("no test name provided", 1)
+			}
+
+			repo := ctx.String("repo")
+			inputs := ctx.StringSlice("input")
+
+			test, err := atomicredteam.Execute(tid, name, repo, inputs)
+			if err != nil {
+				return cli.Exit(err, 1)
+			}
+
+			plan, _ := yaml.Marshal(test)
+
+			now := strings.ReplaceAll(time.Now().UTC().Format(time.RFC3339), ":", ".")
+
+			ioutil.WriteFile(fmt.Sprintf("atomic-test-executor-execution-%s.yaml", now), plan, 0644)
+
+			return nil
+		},
+	}
+
+	if err := app.Run(os.Args); err != nil {
+		fmt.Println(err)
+	}
+
+}