attack_technique: T1072
display_name: Software Deployment Tools
atomic_tests:
- name: Radmin Viewer Utility 
  auto_generated_guid: b4988cad-6ed2-434d-ace5-ea2670782129
  description: |
    An adversary may use Radmin Viewer Utility to remotely control Windows device, this will start the radmin console.
  supported_platforms:
    - windows
  input_arguments:
    radmin_installer:
      description: Radmin Viewer installer
      type: Path
      default: '%TEMP%\RadminViewer.msi'
    radmin_exe:
      description: The radmin.exe executable from RadminViewer.msi
      type: Path
      default: '%PROGRAMFILES(x86)%/Radmin Viewer 3/Radmin.exe'

  dependencies:
    - description: |
        Radmin Viewer Utility must be installed at specified location (#{radmin_exe})
      prereq_command: |
        if not exist "#{radmin_exe}" (exit /b 1)
      get_prereq_command: |
        echo Downloading radmin installer
        bitsadmin /transfer myDownloadJob /download /priority normal "https://www.radmin.com/download/Radmin_Viewer_3.5.2.1_EN.msi" #{radmin_installer}
        msiexec /i "#{radmin_installer}" /qn

  executor:
    name: command_prompt
    elevation_required: true 
    command: | 
      "#{radmin_exe}"