attack_technique: T1059.003
display_name: 'Command and Scripting Interpreter: Windows Command Shell'
atomic_tests:
- name: Create and Execute Batch Script
  auto_generated_guid: 9e8894c0-50bd-4525-a96c-d4ac78ece388
  description: |
    Creates and executes a simple batch script. Upon execution, CMD will briefly launch to run the batch script then close again.
  supported_platforms:
  - windows
  input_arguments:
    command_to_execute:
      description: Command to execute within script.
      type: String
      default: dir
    script_path:
      description: Script path.
      type: Path
      default: $env:TEMP\T1059.003_script.bat
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Batch file must exist on disk at specified location (#{script_path})
    prereq_command: |
      if (Test-Path #{script_path}) {exit 0} else {exit 1}
    get_prereq_command: |
      New-Item #{script_path} -Force | Out-Null
      Set-Content -Path #{script_path} -Value "#{command_to_execute}"
  executor:
    command: |
      Start-Process #{script_path}
    cleanup_command: |
      Remove-Item #{script_path} -Force -ErrorAction Ignore
    name: powershell
- name: Writes text to a file and displays it.
  auto_generated_guid: 127b4afe-2346-4192-815c-69042bec570e
  description: |
    Writes text to a file and display the results. This test is intended to emulate the dropping of a malicious file to disk.
  supported_platforms:
  - windows
  input_arguments:
    file_contents_path:
      description: Path to the file that the command prompt will drop.
      type: Path
      default: '%TEMP%\test.bin'
    message:
      description: Message that will be written to disk and then displayed.
      type: String
      default: 'Hello from the Windows Command Prompt!'
  executor:
    command: |
      echo "#{message}" > "#{file_contents_path}" & type "#{file_contents_path}"
    cleanup_command: |
      del "#{file_contents_path}" >nul 2>&1
    name: command_prompt
- name: Suspicious Execution via Windows Command Shell
  auto_generated_guid: d0eb3597-a1b3-4d65-b33b-2cda8d397f20
  description: |
    Command line executed via suspicious invocation. Example is from the 2021 Threat Detection Report by Red Canary.
  supported_platforms:
  - windows
  input_arguments:
    output_file:
      description: File to output to
      type: String
      default: hello.txt
    input_message:
      description: Message to write to file
      type: String
      default: Hello, from CMD!
  executor:
    command: |
      %LOCALAPPDATA:~-3,1%md /c echo #{input_message} > #{output_file} & type #{output_file}
    name: command_prompt
