diff --git a/atomics/T1218/T1218.yaml b/atomics/T1218/T1218.yaml index 4aca2242..22b66cc3 100644 --- a/atomics/T1218/T1218.yaml +++ b/atomics/T1218/T1218.yaml @@ -134,18 +134,25 @@ atomic_tests: description: XML to execution type: path default: PathToAtomicsFolder\T1218\src\T1218.xml + mwcpath: + description: Default location of Microsoft.Workflow.Compiler.exe + type: Path + default: C:\Windows\Microsoft.NET\Framework64\v4.0.30319 + mwcname: + description: Default name of microsoft.workflow.compiler.exe + type: Path + default: microsoft.workflow.compiler.exe dependency_executor_name: powershell dependencies: - description: | .Net must be installed for this test to work correctly. prereq_command: | - if (Test-Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe ) {exit 0} else {exit 1} + if (Test-Path #{mwcpath}\#{mwcname} ) {exit 0} else {exit 1} get_prereq_command: | write-host ".Net must be installed for this test to work correctly." executor: command: | - Set-Location -path PathToAtomicsFolder\T1218\src ; - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe "#{xml_payload}" output.txt + #{mwcpath}\#{mwcname} "#{xml_payload}" output.txt name: powershell elevation_required: false - name: Renamed Microsoft.Workflow.Compiler.exe Payload Executions @@ -163,18 +170,25 @@ atomic_tests: description: renamed Microsoft.Workflow.Compiler type: path default: PathToAtomicsFolder\T1218\src\svchost.exe + mwcpath: + description: Default location of Microsoft.Workflow.Compiler.exe + type: Path + default: C:\Windows\Microsoft.NET\Framework64\v4.0.30319 + mwcname: + description: Default name of microsoft.workflow.compiler.exe + type: Path + default: microsoft.workflow.compiler.exe dependency_executor_name: powershell dependencies: - description: | .Net must be installed for this test to work correctly. prereq_command: | - Copy-Item C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe "#{renamed_binary}" -Force + Copy-Item #{mwcpath}\#{mwcname} "#{renamed_binary}" -Force if (Test-Path "#{renamed_binary}") {exit 0} else {exit 1} get_prereq_command: | write-host "you need to rename workflow complier before you run this test" executor: command: | - Set-Location -path PathToAtomicsFolder\T1218\src ; #{renamed_binary} #{xml_payload} output.txt name: powershell elevation_required: false