atomics/T1122/T1122.yaml

---
attack_technique: T1122
display_name: Component Object Model Hijacking

atomic_tests:
- name: Component Object Model Hijacking
  description: |
    Hijack COM Object used by certutil.exe

  supported_platforms:
    - windows
  executor:
    name: command_prompt
    command: |
      reg import ..\src\COMHijack.reg
      certutil.exe -CAInfo
    cleanup_command: |
      reg import ..\src\COMHijackCleanup.reg
yamlification 2018-05-24 17:59:15 -06:00			`---`
			`attack_technique: T1122`
Component Object Model Hijacking (#354 ) 2018-09-28 13:08:15 -06:00			`display_name: Component Object Model Hijacking`
yamlification 2018-05-24 17:59:15 -06:00
			`atomic_tests:`
Component Object Model Hijacking (#354 ) 2018-09-28 13:08:15 -06:00			`- name: Component Object Model Hijacking`
yamlification 2018-05-24 17:59:15 -06:00			`description: \|`
Component Object Model Hijacking (#354 ) 2018-09-28 13:08:15 -06:00			`Hijack COM Object used by certutil.exe`
yamlification 2018-05-24 17:59:15 -06:00
			`supported_platforms:`
			`- windows`
			`executor:`
Component Object Model Hijacking (#354 ) 2018-09-28 13:08:15 -06:00			`name: command_prompt`
yamlification 2018-05-24 17:59:15 -06:00			`command: \|`
Component Object Model Hijacking (#354 ) 2018-09-28 13:08:15 -06:00			`reg import ..\src\COMHijack.reg`
			`certutil.exe -CAInfo`
move cleanup/undo commands to cleanup_command attribute (#543 ) 2019-09-03 07:37:06 -06:00			`cleanup_command: \|`
Component Object Model Hijacking (#354 ) 2018-09-28 13:08:15 -06:00			`reg import ..\src\COMHijackCleanup.reg`