attack_technique: T1202
display_name: Indirect Command Execution
atomic_tests:
- name: Indirect Command Execution - pcalua.exe
  auto_generated_guid: cecfea7a-5f03-4cdd-8bc8-6f7c22862440
  description: |
    The Program Compatibility Assistant (pcalua.exe) may invoke the execution of programs and commands from a Command-Line Interface.
    [Reference](https://twitter.com/KyleHanslovan/status/912659279806640128)
    Upon execution, calc.exe should open
  supported_platforms:
  - windows
  input_arguments:
    payload_path:
      description: Path to payload
      type: Path
      default: C:\Windows\System32\calc.exe
    process:
      description: Process to execute
      type: String
      default: calc.exe
  executor:
    command: |
      pcalua.exe -a #{process}
      pcalua.exe -a #{payload_path}
    name: command_prompt
- name: Indirect Command Execution - forfiles.exe
  auto_generated_guid: 8b34a448-40d9-4fc3-a8c8-4bb286faf7dc
  description: |
    forfiles.exe may invoke the execution of programs and commands from a Command-Line Interface.
    [Reference](https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Forfiles.yml)
    "This is basically saying for each occurrence of notepad.exe in c:\windows\system32 run calc.exe"
    Upon execution calc.exe will be opened.
  supported_platforms:
  - windows
  input_arguments:
    process:
      description: Process to execute
      type: String
      default: calc.exe
  executor:
    command: |
      forfiles /p c:\windows\system32 /m notepad.exe /c #{process}
    name: command_prompt
- name: Indirect Command Execution - conhost.exe
  auto_generated_guid: cf3391e0-b482-4b02-87fc-ca8362269b29
  description: |
    conhost.exe refers to a host process for the console window. It provide an interface between command prompt and Windows explorer.
    Executing it through command line can create process ancestry anomalies
    [Reference] (http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/)
  supported_platforms:
  - windows
  input_arguments:
    process:
      description: Process to execute
      type: String
      default: notepad.exe
  executor:
    command: |
      conhost.exe "#{process}"
    name: command_prompt
