diff --git a/atomics/T1112/T1112.yaml b/atomics/T1112/T1112.yaml index 18c40107..05b253f7 100644 --- a/atomics/T1112/T1112.yaml +++ b/atomics/T1112/T1112.yaml @@ -1356,4 +1356,29 @@ atomic_tests: cleanup_command: | reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\BackupPath" /t REG_EXPAND_SZ /d "%SystemRoot%\system32\sdclt.exe" /f name: command_prompt + elevation_required: true + +- name: Adding custom paths for application execution + description: | + As per Microsoft,the entries found under App Paths are used primarily to map an application’s executable file name to that file’s fully qualified path and to pre-pend information to the PATH environment variable on a per-application, per-process basis. + The path can be modified to load a custom application of choice. + Post the registry changes of this test, when someone tries to manually run msedge.exe via StartMenu/Run window , notepad will be launched. + supported_platforms: + - windows + input_arguments: + app_name: + description: path of application to be modified + type: string + default: msedge.exe + new_path: + description: New App Path Added + type: string + default: C:\Windows\System32\notepad.exe + executor: + command: | + reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\#{app_name}" /t REG_SZ /d #{new_path} /f + cleanup_command: | + reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\#{app_name}" /v (Default) /f + reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\#{app_name}" /t REG_SZ /d "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" /f + name: command_prompt elevation_required: true \ No newline at end of file