security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update T1218.yaml (#1360)

Browse Source 
Updated microsoft.workflow.compiler.exe test

Co-authored-by: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
This commit is contained in:
Michael Haag
2021-01-08 09:15:29 -07:00
committed by GitHub
parent 9660d0a33e
commit 39954ec1af
1 changed files with 19 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1218/T1218.yaml
+19 -5
View File
@@ -134,18 +134,25 @@ atomic_tests:
description: XML to execution
type: path
default: PathToAtomicsFolder\T1218\src\T1218.xml
mwcpath:
description: Default location of Microsoft.Workflow.Compiler.exe
type: Path
default: C:\Windows\Microsoft.NET\Framework64\v4.0.30319
mwcname:
description: Default name of microsoft.workflow.compiler.exe
type: Path
default: microsoft.workflow.compiler.exe
dependency_executor_name: powershell
dependencies:
- description: |
.Net must be installed for this test to work correctly.
prereq_command: |
if (Test-Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe ) {exit 0} else {exit 1}
if (Test-Path #{mwcpath}\#{mwcname} ) {exit 0} else {exit 1}
get_prereq_command: |
write-host ".Net must be installed for this test to work correctly."
executor:
command: |
Set-Location -path PathToAtomicsFolder\T1218\src ;
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe "#{xml_payload}" output.txt
#{mwcpath}\#{mwcname} "#{xml_payload}" output.txt
name: powershell
elevation_required: false
- name: Renamed Microsoft.Workflow.Compiler.exe Payload Executions
@@ -163,18 +170,25 @@ atomic_tests:
description: renamed Microsoft.Workflow.Compiler
type: path
default: PathToAtomicsFolder\T1218\src\svchost.exe
mwcpath:
description: Default location of Microsoft.Workflow.Compiler.exe
type: Path
default: C:\Windows\Microsoft.NET\Framework64\v4.0.30319
mwcname:
description: Default name of microsoft.workflow.compiler.exe
type: Path
default: microsoft.workflow.compiler.exe
dependency_executor_name: powershell
dependencies:
- description: |
.Net must be installed for this test to work correctly.
prereq_command: |
Copy-Item C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe "#{renamed_binary}" -Force
Copy-Item #{mwcpath}\#{mwcname} "#{renamed_binary}" -Force
if (Test-Path "#{renamed_binary}") {exit 0} else {exit 1}
get_prereq_command: |
write-host "you need to rename workflow complier before you run this test"
executor:
command: |
Set-Location -path PathToAtomicsFolder\T1218\src ;
#{renamed_binary} #{xml_payload} output.txt
name: powershell
elevation_required: false