diff --git a/atomics/T1569.002/T1569.002.yaml b/atomics/T1569.002/T1569.002.yaml index 7e906f35..58cc88c8 100644 --- a/atomics/T1569.002/T1569.002.yaml +++ b/atomics/T1569.002/T1569.002.yaml @@ -140,3 +140,40 @@ atomic_tests: rm $env:temp\psexec.exe name: powershell elevation_required: true + +- name: Use RemCom to execute a command on a remote host + description: | + Requires having RemCom installed, path to RemCom is one of the input input_arguments + Will start a process on a remote host. + Upon successful execution, cmd will utilize RemCom.exe to spawn calc.exe on a remote endpoint (default:localhost). + supported_platforms: + - windows + input_arguments: + remote_host: + description: Remote hostname or IP address + type: string + default: localhost + user_name: + description: Username + type: string + default: Administrator + password: + description: Password + type: string + default: P@ssw0rd1 + remcom_exe: + description: Path to RemCom + type: string + default: $pathtoatomicsfolder\T1569.002\bin\remcom.exe + dependency_executor_name: powershell + dependencies: + - description: | + RemCom tool must exist on disk at specified location (#{remcom_exe}) + prereq_command: | + if (Test-Path "#{remcom_exe}") { exit 0} else { exit 1} + get_prereq_command: | + Invoke-WebRequest "https://github.com/kavika13/RemCom/raw/master/bin/Release/RemCom.exe" -OutFile "#{remcom_exe}" + executor: + command: | + "#{remcom_exe}" \\#{remote_host} /user:#{user_name} /pwd:#{password} cmd.exe + name: command_prompt