Module directory refactor (#11)

redcanaryco · Sep 14, 2022 · 56fd4b8 · 56fd4b8
1 parent bb21fb3
commit 56fd4b8
Show file tree

Hide file tree

Showing 36 changed files with 26 additions and 22 deletions.
diff --git a/AtomicTestHarnesses.psd1 b/AtomicTestHarnesses.psd1
@@ -1,10 +1,10 @@
 @{
 
 # Script module or binary module file associated with this manifest.
-RootModule = 'AtomicTestHarnesses.psm1'
+RootModule = 'Windows\AtomicTestHarnesses.psm1'
 
 # Version number of this module.
-ModuleVersion = '1.10.0.0'
+ModuleVersion = '1.10.1.0'
 
 # ID used to uniquely identify this module
 GUID = '195a1637-d4a4-4cb3-8d80-5b5d4e3e930a'
@@ -25,7 +25,7 @@ Description = 'A module to facilitate the testing of attack techniques and their
 PowerShellVersion = '5.0'
 
 # Assemblies that must be loaded prior to importing this module
-RequiredAssemblies = @('TestHarnesses\T1218.007_Msiexec\Dependencies\Microsoft.Deployment.WindowsInstaller.dll')
+RequiredAssemblies = @('Windows\TestHarnesses\T1218.007_Msiexec\Dependencies\Microsoft.Deployment.WindowsInstaller.dll')
 
 # Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
 FunctionsToExport = 'Get-ATHDriverService',
@@ -65,9 +65,13 @@ PrivateData = @{
 
         # ReleaseNotes of this module
         ReleaseNotes = @'
+1.10.1
+------
+Improvements:
+* Directory refactoring
 
-1.10.0 
------
+1.10.0
+------
 Added: 
 * Invoke-ATHDumpLSASS
 * Invoke-ATHLogonUser

diff --git a/LICENSE b/LICENSE
@@ -1,6 +1,6 @@
 BSD 3-Clause License
 
-Copyright (c) 2020, Red Canary
+Copyright (c) 2022, Red Canary
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

diff --git a/AtomicTestHarnesses.psm1 → Windows/AtomicTestHarnesses.psm1 b/AtomicTestHarnesses.psm1 → Windows/AtomicTestHarnesses.psm1
diff --git a/...s/T1003.001_DumpLSASS/DumpLSASS.Tests.ps1 → ...s/T1003.001_DumpLSASS/DumpLSASS.Tests.ps1 b/...s/T1003.001_DumpLSASS/DumpLSASS.Tests.ps1 → ...s/T1003.001_DumpLSASS/DumpLSASS.Tests.ps1
@@ -1,7 +1,7 @@
 Set-StrictMode -Version Latest
 
 $TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
-$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\"
+$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\..\"
 $ModuleManifest = "$ModuleRoot\AtomicTestHarnesses.psd1"
 
 Remove-Module [A]tomicTestHarnesses

diff --git a/...rnesses/T1003.001_DumpLSASS/DumpLSASS.ps1 → ...rnesses/T1003.001_DumpLSASS/DumpLSASS.ps1 b/...rnesses/T1003.001_DumpLSASS/DumpLSASS.ps1 → ...rnesses/T1003.001_DumpLSASS/DumpLSASS.ps1
diff --git a/...xecutableInjection/InvokeThread.Tests.ps1 → ...xecutableInjection/InvokeThread.Tests.ps1 b/...xecutableInjection/InvokeThread.Tests.ps1 → ...xecutableInjection/InvokeThread.Tests.ps1
@@ -1,7 +1,7 @@
 Set-StrictMode -Version Latest
 
 $TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
-$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\"
+$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\..\"
 $ModuleManifest = "$ModuleRoot\AtomicTestHarnesses.psd1"
 
 Remove-Module [A]tomicTestHarnesses

diff --git a/...tableExecutableInjection/InvokeThread.ps1 → ...tableExecutableInjection/InvokeThread.ps1 b/...tableExecutableInjection/InvokeThread.ps1 → ...tableExecutableInjection/InvokeThread.ps1
diff --git a/...rocessInjection/ProcessHerpderp.Tests.ps1 → ...rocessInjection/ProcessHerpderp.Tests.ps1 b/...rocessInjection/ProcessHerpderp.Tests.ps1 → ...rocessInjection/ProcessHerpderp.Tests.ps1
@@ -1,7 +1,7 @@
 Set-StrictMode -Version Latest
 
 $TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
-$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\"
+$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\..\"
 $ModuleManifest = "$ModuleRoot\AtomicTestHarnesses.psd1"
 
 Remove-Module [A]tomicTestHarnesses

diff --git a/...1055_ProcessInjection/ProcessHerpderp.ps1 → ...1055_ProcessInjection/ProcessHerpderp.ps1 b/...1055_ProcessInjection/ProcessHerpderp.ps1 → ...1055_ProcessInjection/ProcessHerpderp.ps1
diff --git a/...tPowerShellCommandLineParameter.Tests.ps1 → ...tPowerShellCommandLineParameter.Tests.ps1 b/...tPowerShellCommandLineParameter.Tests.ps1 → ...tPowerShellCommandLineParameter.Tests.ps1
@@ -1,7 +1,7 @@
 Set-StrictMode -Version Latest
 
 $TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
-$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\"
+$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\..\"
 $ModuleManifest = "$ModuleRoot\AtomicTestHarnesses.psd1"
 
 Remove-Module [A]tomicTestHarnesses

diff --git a/...ell/OutPowerShellCommandLineParameter.ps1 → ...ell/OutPowerShellCommandLineParameter.ps1 b/...ell/OutPowerShellCommandLineParameter.ps1 → ...ell/OutPowerShellCommandLineParameter.ps1
diff --git a/...078.003_ValidAccounts/LogonUser.Tests.ps1 → ...078.003_ValidAccounts/LogonUser.Tests.ps1 b/...078.003_ValidAccounts/LogonUser.Tests.ps1 → ...078.003_ValidAccounts/LogonUser.Tests.ps1
@@ -1,7 +1,7 @@
 Set-StrictMode -Version Latest
 
 $TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
-$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\"
+$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\..\"
 $ModuleManifest = "$ModuleRoot\AtomicTestHarnesses.psd1"
 
 Remove-Module [A]tomicTestHarnesses

diff --git a/...ses/T1078.003_ValidAccounts/LogonUser.ps1 → ...ses/T1078.003_ValidAccounts/LogonUser.ps1 b/...ses/T1078.003_ValidAccounts/LogonUser.ps1 → ...ses/T1078.003_ValidAccounts/LogonUser.ps1
diff --git a/...T1127.001_MSBuild/InvokeMSBuild.Tests.ps1 → ...T1127.001_MSBuild/InvokeMSBuild.Tests.ps1 b/...T1127.001_MSBuild/InvokeMSBuild.Tests.ps1 → ...T1127.001_MSBuild/InvokeMSBuild.Tests.ps1
@@ -1,7 +1,7 @@
 Set-StrictMode -Version Latest
 
 $TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
-$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\"
+$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\..\"
 $ModuleManifest = "$ModuleRoot\AtomicTestHarnesses.psd1"
 
 Remove-Module [A]tomicTestHarnesses

diff --git a/...esses/T1127.001_MSBuild/InvokeMSBuild.ps1 → ...esses/T1127.001_MSBuild/InvokeMSBuild.ps1 b/...esses/T1127.001_MSBuild/InvokeMSBuild.ps1 → ...esses/T1127.001_MSBuild/InvokeMSBuild.ps1
diff --git a/...mpersonation/TokenImpersonation.Tests.ps1 → ...mpersonation/TokenImpersonation.Tests.ps1 b/...mpersonation/TokenImpersonation.Tests.ps1 → ...mpersonation/TokenImpersonation.Tests.ps1
@@ -1,7 +1,7 @@
 Set-StrictMode -Version Latest
 
 $TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
-$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\"
+$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\..\"
 $ModuleManifest = "$ModuleRoot\AtomicTestHarnesses.psd1"
 
 Remove-Module [A]tomicTestHarnesses

diff --git a/...TokenImpersonation/TokenImpersonation.ps1 → ...TokenImpersonation/TokenImpersonation.ps1 b/...TokenImpersonation/TokenImpersonation.ps1 → ...TokenImpersonation/TokenImpersonation.ps1
diff --git a/...ithToken/CreateProcessWithToken.Tests.ps1 → ...ithToken/CreateProcessWithToken.Tests.ps1 b/...ithToken/CreateProcessWithToken.Tests.ps1 → ...ithToken/CreateProcessWithToken.Tests.ps1
@@ -1,7 +1,7 @@
 Set-StrictMode -Version Latest
 
 $TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
-$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\"
+$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\..\"
 $ModuleManifest = "$ModuleRoot\AtomicTestHarnesses.psd1"
 
 Remove-Module [A]tomicTestHarnesses

diff --git a/...ocessWithToken/CreateProcessWithToken.ps1 → ...ocessWithToken/CreateProcessWithToken.ps1 b/...ocessWithToken/CreateProcessWithToken.ps1 → ...ocessWithToken/CreateProcessWithToken.ps1
diff --git a/...004_ParentPIDSpoofing/PPIDSpoof.Tests.ps1 → ...004_ParentPIDSpoofing/PPIDSpoof.Tests.ps1 b/...004_ParentPIDSpoofing/PPIDSpoof.Tests.ps1 → ...004_ParentPIDSpoofing/PPIDSpoof.Tests.ps1
@@ -1,7 +1,7 @@
 Set-StrictMode -Version Latest
 
 $TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
-$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\"
+$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\..\"
 $ModuleManifest = "$ModuleRoot\AtomicTestHarnesses.psd1"
 
 Remove-Module [A]tomicTestHarnesses

diff --git a/...T1134.004_ParentPIDSpoofing/PPIDSpoof.ps1 → ...T1134.004_ParentPIDSpoofing/PPIDSpoof.ps1 b/...T1134.004_ParentPIDSpoofing/PPIDSpoof.ps1 → ...T1134.004_ParentPIDSpoofing/PPIDSpoof.ps1
diff --git a/...HTMLFile/InvokeCompiledHTMLFile.Tests.ps1 → ...HTMLFile/InvokeCompiledHTMLFile.Tests.ps1 b/...HTMLFile/InvokeCompiledHTMLFile.Tests.ps1 → ...HTMLFile/InvokeCompiledHTMLFile.Tests.ps1
@@ -1,7 +1,7 @@
 Set-StrictMode -Version Latest
 
 $TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
-$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\"
+$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\..\"
 $ModuleManifest = "$ModuleRoot\AtomicTestHarnesses.psd1"
 
 Remove-Module [A]tomicTestHarnesses

diff --git a/...mpiledHTMLFile/InvokeCompiledHTMLFile.ps1 → ...mpiledHTMLFile/InvokeCompiledHTMLFile.ps1 b/...mpiledHTMLFile/InvokeCompiledHTMLFile.ps1 → ...mpiledHTMLFile/InvokeCompiledHTMLFile.ps1
diff --git a/...005_Mshta/InvokeHTMLApplication.Tests.ps1 → ...005_Mshta/InvokeHTMLApplication.Tests.ps1 b/...005_Mshta/InvokeHTMLApplication.Tests.ps1 → ...005_Mshta/InvokeHTMLApplication.Tests.ps1
@@ -1,7 +1,7 @@
 Set-StrictMode -Version Latest
 
 $TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
-$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\"
+$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\..\"
 $ModuleManifest = "$ModuleRoot\AtomicTestHarnesses.psd1"
 
 Remove-Module [A]tomicTestHarnesses

diff --git a/...T1218.005_Mshta/InvokeHTMLApplication.ps1 → ...T1218.005_Mshta/InvokeHTMLApplication.ps1 b/...T1218.005_Mshta/InvokeHTMLApplication.ps1 → ...T1218.005_Mshta/InvokeHTMLApplication.ps1
diff --git a/...1218.007_Msiexec/Dependencies/LICENSE.TXT → ...1218.007_Msiexec/Dependencies/LICENSE.TXT b/...1218.007_Msiexec/Dependencies/LICENSE.TXT → ...1218.007_Msiexec/Dependencies/LICENSE.TXT
diff --git a/...Microsoft.Deployment.WindowsInstaller.dll → ...Microsoft.Deployment.WindowsInstaller.dll b/...Microsoft.Deployment.WindowsInstaller.dll → ...Microsoft.Deployment.WindowsInstaller.dll
diff --git a/...ses/T1218.007_Msiexec/InvokeMSI.Tests.ps1 → ...ses/T1218.007_Msiexec/InvokeMSI.Tests.ps1 b/...ses/T1218.007_Msiexec/InvokeMSI.Tests.ps1 → ...ses/T1218.007_Msiexec/InvokeMSI.Tests.ps1
@@ -1,7 +1,7 @@
 Set-StrictMode -Version Latest
 
 $TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
-$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\"
+$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\..\"
 $ModuleManifest = "$ModuleRoot\AtomicTestHarnesses.psd1"
 
 Remove-Module [A]tomicTestHarnesses

diff --git a/...Harnesses/T1218.007_Msiexec/InvokeMSI.ps1 → ...Harnesses/T1218.007_Msiexec/InvokeMSI.ps1 b/...Harnesses/T1218.007_Msiexec/InvokeMSI.ps1 → ...Harnesses/T1218.007_Msiexec/InvokeMSI.ps1
diff --git a/...eRemoteFXvGPUDisablementCommand.Tests.ps1 → ...eRemoteFXvGPUDisablementCommand.Tests.ps1 b/...eRemoteFXvGPUDisablementCommand.Tests.ps1 → ...eRemoteFXvGPUDisablementCommand.Tests.ps1
@@ -1,7 +1,7 @@
 Set-StrictMode -Version Latest
 
 $TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
-$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\"
+$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\..\"
 $ModuleManifest = "$ModuleRoot\AtomicTestHarnesses.psd1"
 
 Remove-Module [A]tomicTestHarnesses

diff --git a/.../InvokeRemoteFXvGPUDisablementCommand.ps1 → .../InvokeRemoteFXvGPUDisablementCommand.ps1 b/.../InvokeRemoteFXvGPUDisablementCommand.ps1 → .../InvokeRemoteFXvGPUDisablementCommand.ps1
diff --git a/..._WindowsService/DriverInstaller.Tests.ps1 → ..._WindowsService/DriverInstaller.Tests.ps1 b/..._WindowsService/DriverInstaller.Tests.ps1 → ..._WindowsService/DriverInstaller.Tests.ps1
@@ -1,7 +1,7 @@
 Set-StrictMode -Version Latest
 
 $TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
-$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\"
+$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\..\"
 $ModuleManifest = "$ModuleRoot\AtomicTestHarnesses.psd1"
 
 Remove-Module [A]tomicTestHarnesses

diff --git a/...43.003_WindowsService/DriverInstaller.ps1 → ...43.003_WindowsService/DriverInstaller.ps1 b/...43.003_WindowsService/DriverInstaller.ps1 → ...43.003_WindowsService/DriverInstaller.ps1
diff --git a/...12_COR_PROFILER/LoadCORProfiler.Tests.ps1 → ...12_COR_PROFILER/LoadCORProfiler.Tests.ps1 b/...12_COR_PROFILER/LoadCORProfiler.Tests.ps1 → ...12_COR_PROFILER/LoadCORProfiler.Tests.ps1
@@ -1,7 +1,7 @@
 Set-StrictMode -Version Latest
 
 $TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
-$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\"
+$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\..\"
 $ModuleManifest = "$ModuleRoot\AtomicTestHarnesses.psd1"
 
 Remove-Module [A]tomicTestHarnesses

diff --git a/...1574.012_COR_PROFILER/LoadCORProfiler.ps1 → ...1574.012_COR_PROFILER/LoadCORProfiler.ps1 b/...1574.012_COR_PROFILER/LoadCORProfiler.ps1 → ...1574.012_COR_PROFILER/LoadCORProfiler.ps1
diff --git a/Tests/Module.Tests.ps1 → Windows/Tests/Module.Tests.ps1 b/Tests/Module.Tests.ps1 → Windows/Tests/Module.Tests.ps1
@@ -1,7 +1,7 @@
 Set-StrictMode -Version Latest
 
 $TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
-$ModuleRoot = Resolve-Path "$TestScriptRoot\.."
+$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\"
 $ModuleManifest = "$ModuleRoot\AtomicTestHarnesses.psd1"
 
 Remove-Module [A]tomicTestHarnesses