attack_technique: T1106
display_name: Native API
atomic_tests:
- name: Execution through API - CreateProcess
  auto_generated_guid: 99be2089-c52d-4a4a-b5c3-261ee42c8b62
  description: Execute program by leveraging Win32 API's. By default, this will launch calc.exe from the command prompt.
  supported_platforms:
  - windows
  input_arguments:
    source_file:
      description: Location of the CSharp source file to compile and execute
      type: Path
      default: PathToAtomicsFolder\T1106\src\CreateProcess.cs
    output_file:
      description: Location of the payload
      type: Path
      default: '%tmp%\T1106.exe'
  executor:
    command: |
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:"#{output_file}" /target:exe #{source_file}
      %tmp%/T1106.exe
    name: command_prompt

