diff --git a/atomics/T1173/T1173.md b/atomics/T1173/T1173.md index 31ec2dc2..94af3ec2 100644 --- a/atomics/T1173/T1173.md +++ b/atomics/T1173/T1173.md @@ -10,6 +10,8 @@ Adversaries may use DDE to execute arbitrary commands. Microsoft Office document - [Atomic Test #1 - Execute Commands](#atomic-test-1---execute-commands) +- [Atomic Test #2 - Execute PowerShell script via Word DDE](#atomic-test-2---execute-powershell-script-via-word-dde) +
@@ -36,4 +38,20 @@ The Field Code should now be displayed, change it to Contain the following: +
+
+ +## Atomic Test #2 - Execute PowerShell script via Word DDE +When the word document opens it will prompt the user to click ok on a dialogue box, then attempt to run PowerShell with DDEAUTO to download and execute a powershell script + +**Supported Platforms:** Windows + + +#### Run it with `command_prompt`! +``` +start $PathToAtomicsFolder\T1173\bin\DDE_Document.docx +``` + + +
diff --git a/atomics/index.md b/atomics/index.md index 4d508566..0c585c57 100644 --- a/atomics/index.md +++ b/atomics/index.md @@ -686,6 +686,7 @@ - Atomic Test #1: Control Panel Items [windows] - [T1173 Dynamic Data Exchange](./T1173/T1173.md) - Atomic Test #1: Execute Commands [windows] + - Atomic Test #2: Execute PowerShell script via Word DDE [windows] - T1106 Execution through API [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) - T1129 Execution through Module Load [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) - T1203 Exploitation for Client Execution [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) diff --git a/atomics/index.yaml b/atomics/index.yaml index ed3b1815..78856b93 100644 --- a/atomics/index.yaml +++ b/atomics/index.yaml @@ -19523,6 +19523,20 @@ execution: The Field Code should now be displayed, change it to Contain the following: {DDEAUTO c:\\windows\\system32\\cmd.exe "/k calc.exe" } + - name: Execute PowerShell script via Word DDE + description: 'When the word document opens it will prompt the user to click + ok on a dialogue box, then attempt to run PowerShell with DDEAUTO to download + and execute a powershell script + +' + supported_platforms: + - windows + executor: + name: command_prompt + elevation_required: false + command: 'start $PathToAtomicsFolder\T1173\bin\DDE_Document.docx + +' T1118: technique: x_mitre_data_sources: diff --git a/atomics/windows-index.md b/atomics/windows-index.md index 527af882..6118f7c1 100644 --- a/atomics/windows-index.md +++ b/atomics/windows-index.md @@ -555,6 +555,7 @@ - Atomic Test #1: Control Panel Items [windows] - [T1173 Dynamic Data Exchange](./T1173/T1173.md) - Atomic Test #1: Execute Commands [windows] + - Atomic Test #2: Execute PowerShell script via Word DDE [windows] - T1106 Execution through API [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) - T1129 Execution through Module Load [CONTRIBUTE A TEST](https://atomicredteam.io/contributing) - T1203 Exploitation for Client Execution [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)