diff --git a/atomics/T1173/T1173.md b/atomics/T1173/T1173.md
index 31ec2dc2..94af3ec2 100644
--- a/atomics/T1173/T1173.md
+++ b/atomics/T1173/T1173.md
@@ -10,6 +10,8 @@ Adversaries may use DDE to execute arbitrary commands. Microsoft Office document
- [Atomic Test #1 - Execute Commands](#atomic-test-1---execute-commands)
+- [Atomic Test #2 - Execute PowerShell script via Word DDE](#atomic-test-2---execute-powershell-script-via-word-dde)
+
@@ -36,4 +38,20 @@ The Field Code should now be displayed, change it to Contain the following:
+
+
+
+## Atomic Test #2 - Execute PowerShell script via Word DDE
+When the word document opens it will prompt the user to click ok on a dialogue box, then attempt to run PowerShell with DDEAUTO to download and execute a powershell script
+
+**Supported Platforms:** Windows
+
+
+#### Run it with `command_prompt`!
+```
+start $PathToAtomicsFolder\T1173\bin\DDE_Document.docx
+```
+
+
+
diff --git a/atomics/index.md b/atomics/index.md
index 4d508566..0c585c57 100644
--- a/atomics/index.md
+++ b/atomics/index.md
@@ -686,6 +686,7 @@
- Atomic Test #1: Control Panel Items [windows]
- [T1173 Dynamic Data Exchange](./T1173/T1173.md)
- Atomic Test #1: Execute Commands [windows]
+ - Atomic Test #2: Execute PowerShell script via Word DDE [windows]
- T1106 Execution through API [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1129 Execution through Module Load [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1203 Exploitation for Client Execution [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
diff --git a/atomics/index.yaml b/atomics/index.yaml
index ed3b1815..78856b93 100644
--- a/atomics/index.yaml
+++ b/atomics/index.yaml
@@ -19523,6 +19523,20 @@ execution:
The Field Code should now be displayed, change it to Contain the following:
{DDEAUTO c:\\windows\\system32\\cmd.exe "/k calc.exe" }
+ - name: Execute PowerShell script via Word DDE
+ description: 'When the word document opens it will prompt the user to click
+ ok on a dialogue box, then attempt to run PowerShell with DDEAUTO to download
+ and execute a powershell script
+
+'
+ supported_platforms:
+ - windows
+ executor:
+ name: command_prompt
+ elevation_required: false
+ command: 'start $PathToAtomicsFolder\T1173\bin\DDE_Document.docx
+
+'
T1118:
technique:
x_mitre_data_sources:
diff --git a/atomics/windows-index.md b/atomics/windows-index.md
index 527af882..6118f7c1 100644
--- a/atomics/windows-index.md
+++ b/atomics/windows-index.md
@@ -555,6 +555,7 @@
- Atomic Test #1: Control Panel Items [windows]
- [T1173 Dynamic Data Exchange](./T1173/T1173.md)
- Atomic Test #1: Execute Commands [windows]
+ - Atomic Test #2: Execute PowerShell script via Word DDE [windows]
- T1106 Execution through API [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1129 Execution through Module Load [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1203 Exploitation for Client Execution [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)