attack_technique: T1140
display_name: Deobfuscate/Decode Files or Information
atomic_tests:
- name: Deobfuscate/Decode Files Or Information
  auto_generated_guid: dc6fe391-69e6-4506-bd06-ea5eeb4082f8
  description: |
    Encode/Decode executable
    Upon execution a file named T1140_calc_decoded.exe will be placed in the temp folder
  supported_platforms:
  - windows
  input_arguments:
    executable:
      description: name of executable
      type: Path
      default: C:\Windows\System32\calc.exe
  executor:
    command: |
      certutil -encode #{executable} %temp%\T1140_calc.txt
      certutil -decode %temp%\T1140_calc.txt %temp%\T1140_calc_decoded.exe
    cleanup_command: |
      del %temp%\T1140_calc.txt >nul 2>&1
      del %temp%\T1140_calc_decoded.exe >nul 2>&1
    name: command_prompt
- name: Certutil Rename and Decode
  auto_generated_guid: 71abc534-3c05-4d0c-80f7-cbe93cb2aa94
  description: |
    Rename certutil and decode a file. This is in reference to latest research by FireEye [here](https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html)
  supported_platforms:
  - windows
  input_arguments:
    executable:
      description: name of executable/file to decode
      type: Path
      default: C:\Windows\System32\calc.exe
  executor:
    command: |
      copy %windir%\system32\certutil.exe %temp%\tcm.tmp
      %temp%\tcm.tmp -encode #{executable} %temp%\T1140_calc2.txt
      %temp%\tcm.tmp -decode %temp%\T1140_calc2.txt %temp%\T1140_calc2_decoded.exe
    cleanup_command: |
      del %temp%\tcm.tmp >nul 2>&1
      del %temp%\T1140_calc2.txt >nul 2>&1
      del %temp%\T1140_calc2_decoded.exe >nul 2>&1
    name: command_prompt
- name: Base64 decoding with Python
  auto_generated_guid: 356dc0e8-684f-4428-bb94-9313998ad608
  description: |
    Use Python to decode a base64-encoded text string and echo it to the console
  supported_platforms:
  - linux
  - macos
  input_arguments:
    message:
      description: Message to print to the screen
      type: String
      default: Hello from Atomic Red Team test T1140!
    encoded_file:
      description: File to temporarily save encoded text
      type: Path
      default: /tmp/T1140.encoded
  dependencies:
    - description: |
        Python must be present
      prereq_command: |
        which python3
      get_prereq_command: |
        echo "Please install Python 3"
  executor:
    name: sh
    elevation_required: false
    command: |
      ENCODED=$(python3 -c 'import base64;enc=base64.b64encode("#{message}".encode());print(enc.decode())')
      python3 -c "import base64;dec=base64.b64decode(\"$ENCODED\");print(dec.decode())"
      python3 -c "import base64 as d;dec=d.b64decode(\"$ENCODED\");print(dec.decode())"
      python3 -c "from base64 import b64decode;dec=b64decode(\"$ENCODED\");print(dec.decode())"
      python3 -c "from base64 import b64decode as d;dec=d(\"$ENCODED\");print(dec.decode())"
      echo $ENCODED | python3 -c "import base64,sys;dec=base64.b64decode(sys.stdin.read());print(dec.decode())"
      echo $ENCODED > #{encoded_file} && python3 -c "import base64;dec=base64.b64decode(open('#{encoded_file}').read());print(dec.decode())"
- name: Base64 decoding with Perl
  auto_generated_guid: 6604d964-b9f6-4d4b-8ce8-499829a14d0a
  description: |
    Use Perl to decode a base64-encoded text string and echo it to the console
  supported_platforms:
  - linux
  - macos
  input_arguments:
    message:
      description: Message to print to the screen
      type: String
      default: Hello from Atomic Red Team test T1140!
    encoded_file:
      description: File to temporarily save encoded text
      type: Path
      default: /tmp/T1140.encoded
  dependencies:
    - description: |
        Perl must be present
      prereq_command: |
        which perl
      get_prereq_command: |
        echo "Please install Perl"
  executor:
    name: sh
    elevation_required: false
    command: |
      ENCODED=$(perl -e "use MIME::Base64;print(encode_base64('#{message}'));")
      perl -le "use MIME::Base64;print(decode_base64('$ENCODED'));"
      echo $ENCODED | perl -le 'use MIME::Base64;print(decode_base64(<STDIN>));'
      echo $ENCODED > #{encoded_file} && perl -le 'use MIME::Base64;open($f,"<","#{encoded_file}");print(decode_base64(<$f>));'
- name: Base64 decoding with shell utilities
  auto_generated_guid: b4f6a567-a27a-41e5-b8ef-ac4b4008bb7e
  description: |
    Use common shell utilities to decode a base64-encoded text string and echo it to the console
  supported_platforms:
  - linux
  - macos
  input_arguments:
    message:
      description: Message to print to the screen
      type: String
      default: Hello from Atomic Red Team test T1140!
    encoded_file:
      description: File to temporarily save encoded text
      type: Path
      default: /tmp/T1140.encoded
  executor:
    name: sh
    elevation_required: false
    command: |
      ENCODED=$(echo '#{message}' | base64)
      printf $ENCODED | base64 -d
      echo $ENCODED | base64 -d
      echo $(echo $ENCODED) | base64 -d
      echo $ENCODED > #{encoded_file} && base64 -d #{encoded_file}
      echo $ENCODED > #{encoded_file} && base64 -d < #{encoded_file}
      echo $ENCODED > #{encoded_file} && cat #{encoded_file} | base64 -d
      echo $ENCODED > #{encoded_file} && cat < #{encoded_file} | base64 -d
      bash -c "{echo,\"$(echo $ENCODED)\"}|{base64,-d}"
- name: Hex decoding with shell utilities
  auto_generated_guid: 005943f9-8dd5-4349-8b46-0313c0a9f973
  description: |
    Use common shell utilities to decode a hex-encoded text string and echo it to the console
  supported_platforms:
  - linux
  - macos
  input_arguments:
    message:
      description: Message to print to the screen
      type: String
      default: Hello from Atomic Red Team test T1140!
    encoded_file:
      description: File to temporarily save encoded text
      type: Path
      default: /tmp/T1140.encoded
  dependencies:
    - description: |
        xxd must be present
      prereq_command: |
        which xxd
      get_prereq_command: |
        echo "Please install xxd"
  executor:
    name: sh
    elevation_required: false
    command: |
      ENCODED=$(echo '#{message}' | xxd -ps -c 256)
      printf $ENCODED | xxd -r -p
      echo $ENCODED | xxd -r -p
      echo $(echo $ENCODED) | xxd -r -p
      echo $ENCODED > #{encoded_file} && xxd -r -p #{encoded_file}
      echo $ENCODED > #{encoded_file} && xxd -r -p < #{encoded_file}
      echo $ENCODED > #{encoded_file} && cat #{encoded_file} | xxd -r -p
      echo $ENCODED > #{encoded_file} && cat < #{encoded_file} | xxd -r -p
