Test your coverage of AppLocker abuse

Atomic Red Team co-creater Mike Haag recently published a technical deep dive into Microsoft's AppLocker, featuring some Atomic Red Team tests and tutorials for how to validate your defenses against adversaries abusing this application control program.

Lock it down

Meet Atomic Lua

As featured on Atomics on the Friday, Atomic Lua is a collection of GitHub Actions and workflows to help defenders better understand and use Lua, a programming language known to be leveraged by certain malware families.

PR opportunity: Some of these behaviors could be incorporated into Atomic Red Team tests, so if you've yet to push your first commit, get that free t-shirt!

LEARN LUA

NEW TESTS

T1105 - Ingress Tool Transfer

File download with sqlcmd.exe

T1219 - Remote File Transfer

Splashtop Streamer execution

T1569.002 - Service Execution

Modifying ACL of Service Control Manager via SDETPermalink

Top contributors

First-time contributors

Atomic in the wild

WATCH: Atomic Ransomware Emulation

Register for a free SANS account to watch all of the talks from the 2024 Ransomware Summit on-demand, including Gerry Johansen's "Atomic Ransomware Emulation."

Check out Ashton Rodenhiser's live illustration of the talk as well:

Join Red Canary’s Gerry Johansen on May 31 as he presents how to use Atomic Red Team to validate your defenses against ransomware attacks.

Dig through the Atomic Newsletter archive

Our new and improved archive includes every Atomic Newsletter ever published, organized by month.

REMINISCE