atomics/T1221/T1221.yaml

attack_technique: T1221
display_name: Template Injection
atomic_tests:
- name: WINWORD Remote Template Injection
  auto_generated_guid: 1489e08a-82c7-44ee-b769-51b72d03521d
  description: |
    Open a .docx file that loads a remote .dotm macro enabled template from https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1221/src/opencalc.dotm 
    Executes the code specified within the .dotm template.
    Requires download of WINWORD found in Microsoft Ofiice at Microsoft: https://www.microsoft.com/en-us/download/office.aspx.  
    Default docs file opens Calculator.exe when test sucessfully executed, while AV turned off.
  supported_platforms:
  - windows
  input_arguments:
    docx_file:
      description: Location of the test docx file on the local filesystem.
      type: path
      default: PathToAtomicsFolder\T1221\src\Calculator.docx
  executor:
    command: |
      start "#{docx_file}"
    name: command_prompt
Test for T1221 Remote Template Injection (#1424 ) 2021-04-18 05:57:22 +02:00			`attack_technique: T1221`
			`display_name: Template Injection`
			`atomic_tests:`
			`- name: WINWORD Remote Template Injection`
Generate GUIDs from job=generate_and_commit_guids_and_docs branch=master [skip ci] 2021-04-18 03:57:37 +00:00			`auto_generated_guid: 1489e08a-82c7-44ee-b769-51b72d03521d`
Test for T1221 Remote Template Injection (#1424 ) 2021-04-18 05:57:22 +02:00			`description: \|`
remove unused arg, utilize other arg (#1497 ) 2021-06-09 10:55:25 -06:00			`Open a .docx file that loads a remote .dotm macro enabled template from https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1221/src/opencalc.dotm`
			`Executes the code specified within the .dotm template.`
			`Requires download of WINWORD found in Microsoft Ofiice at Microsoft: https://www.microsoft.com/en-us/download/office.aspx.`
			`Default docs file opens Calculator.exe when test sucessfully executed, while AV turned off.`
Test for T1221 Remote Template Injection (#1424 ) 2021-04-18 05:57:22 +02:00			`supported_platforms:`
			`- windows`
			`input_arguments:`
remove unused arg, utilize other arg (#1497 ) 2021-06-09 10:55:25 -06:00			`docx_file:`
Test for T1221 Remote Template Injection (#1424 ) 2021-04-18 05:57:22 +02:00			`description: Location of the test docx file on the local filesystem.`
fix: Updating atomics YAML file structure to align with the new JSON schema definition (#2323 ) 2023-02-13 17:10:37 -06:00			`type: path`
Test for T1221 Remote Template Injection (#1424 ) 2021-04-18 05:57:22 +02:00			`default: PathToAtomicsFolder\T1221\src\Calculator.docx`
			`executor:`
			`command: \|`
Handle spaces in file paths (#2535 ) 2023-09-22 10:47:25 -06:00			`start "#{docx_file}"`
Test for T1221 Remote Template Injection (#1424 ) 2021-04-18 05:57:22 +02:00			`name: command_prompt`