attack_technique: T1055.004
display_name: 'Process Injection: Asynchronous Procedure Call'
atomic_tests:
- name: Process Injection via C#
  auto_generated_guid: 611b39b7-e243-4c81-87a4-7145a90358b1
  description: |
    Process Injection using C#
    reference: https://github.com/pwndizzle/c-sharp-memory-injection
    Excercises Five Techniques
    1. Process injection
    2. ApcInjectionAnyProcess
    3. ApcInjectionNewProcess
    4. IatInjection
    5. ThreadHijack
    Upon successful execution, cmd.exe will execute T1055.exe, which exercises 5 techniques. Output will be via stdout.
  supported_platforms:
  - windows
  input_arguments:
    exe_binary:
      description: Output Binary
      type: Path
      default: PathToAtomicsFolder\T1055.004\bin\T1055.exe
  executor:
    command: |
      #{exe_binary}
    name: command_prompt

