attack_technique: T1027.002
display_name: 'Obfuscated Files or Information: Software Packing'
atomic_tests:
- name: Binary simply packed by UPX (linux)
  auto_generated_guid: 11c46cd8-e471-450e-acb8-52a1216ae6a4
  description: |
    Copies and then runs a simple binary (just outputting "the cake is a lie"), that was packed by UPX.
    No other protection/compression were applied.
  supported_platforms:
  - linux
  input_arguments:
    bin_path:
      description: Packed binary
      type: Path
      default: PathToAtomicsFolder/T1027.002/bin/linux/test_upx
  executor:
    command: |
      cp #{bin_path} /tmp/packed_bin && /tmp/packed_bin
    cleanup_command: |
      rm /tmp/packed_bin
    name: sh
- name: Binary packed by UPX, with modified headers (linux)
  auto_generated_guid: f06197f8-ff46-48c2-a0c6-afc1b50665e1
  description: |
    Copies and then runs a simple binary (just outputting "the cake is a lie"), that was packed by UPX.

    The UPX magic number (`0x55505821`, "`UPX!`") was changed to (`0x4c4f5452`, "`LOTR`"). This prevents the binary from being detected
    by some methods, and especially UPX is not able to uncompress it any more.
  supported_platforms:
  - linux
  input_arguments:
    bin_path:
      description: Packed binary
      type: Path
      default: PathToAtomicsFolder/T1027.002/bin/linux/test_upx_header_changed
  executor:
    command: |
      cp #{bin_path} /tmp/packed_bin && /tmp/packed_bin
    cleanup_command: |
      rm /tmp/packed_bin
    name: sh
- name: Binary simply packed by UPX
  auto_generated_guid: b16ef901-00bb-4dda-b4fc-a04db5067e20
  description: |
    Copies and then runs a simple binary (just outputting "the cake is a lie"), that was packed by UPX.
    No other protection/compression were applied.
  supported_platforms:
  - macos
  input_arguments:
    bin_path:
      description: Packed binary
      type: Path
      default: PathToAtomicsFolder/T1027.002/bin/darwin/test_upx
  executor:
    command: |
      cp #{bin_path} /tmp/packed_bin && /tmp/packed_bin
    cleanup_command: |
      rm /tmp/packed_bin
    name: sh
- name: Binary packed by UPX, with modified headers
  auto_generated_guid: 4d46e16b-5765-4046-9f25-a600d3e65e4d
  description: |
    Copies and then runs a simple binary (just outputting "the cake is a lie"), that was packed by UPX.

    The UPX magic number (`0x55505821`, "`UPX!`") was changed to (`0x4c4f5452`, "`LOTR`"). This prevents the binary from being detected
    by some methods, and especially UPX is not able to uncompress it any more.
  supported_platforms:
  - macos
  input_arguments:
    bin_path:
      description: Packed binary
      type: Path
      default: PathToAtomicsFolder/T1027.002/bin/darwin/test_upx_header_changed
  executor:
    command: |
      cp #{bin_path} /tmp/packed_bin && /tmp/packed_bin
    cleanup_command: |
      rm /tmp/packed_bin
    name: sh

