Replaced the ${atomics_path} input variable with the (#761)

$PathToAtomicsFolder global variable. Removed the input variable block
for simplicity.

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
This commit is contained in:
dwhite9
2019-12-30 09:20:25 -06:00
committed by Carrie Roberts
parent eac69aa2d9
commit 1d37472ced
+1 -6
View File
@@ -43,15 +43,10 @@ atomic_tests:
This attempts to emulate what FIN7 does with this technique which is using mshta.exe to execute VBScript to execute malicious code on victim systems.
supported_platforms:
- windows
input_arguments:
atomics_path:
description: path to atomics folder
type: path
default: ..\..\atomics
executor:
name: command_prompt
command: |
mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell -noexit -file #{atomics_path}\T1170\src\powershell.ps1"":close")
mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell -noexit -file $PathToAtomicsFolder\T1170\src\powershell.ps1"":close")
- name: Mshta Executes Remote HTML Application (HTA)
description: |