diff --git a/atomics/T1127.001/T1127.001.yaml b/atomics/T1127.001/T1127.001.yaml index 3d6232f3..18ae7618 100644 --- a/atomics/T1127.001/T1127.001.yaml +++ b/atomics/T1127.001/T1127.001.yaml @@ -1,7 +1,7 @@ attack_technique: T1127.001 display_name: 'Trusted Developer Utilities Proxy Execution: MSBuild' atomic_tests: -- name: MSBuild Bypass Using Inline Tasks +- name: MSBuild Bypass Using Inline Tasks (C#) auto_generated_guid: 58742c0f-cb01-44cd-a60b-fb26e8871c93 description: | Executes the code in a project file using msbuild.exe. The default C# project example file (T1127.001.csproj) will simply print "Hello From a Code Fragment" and "Hello From a Class." to the screen. @@ -33,3 +33,35 @@ atomic_tests: command: | #{msbuildpath}\#{msbuildname} #{filename} name: command_prompt + +- name: MSBuild Bypass Using Inline Tasks (VB) + description: | + Executes the code in a project file using msbuild.exe. The default Visual Basic example file (vb.xml) will simply print "Hello from a Visual Basic inline task!" to the screen. + supported_platforms: + - windows + input_arguments: + filename: + description: Location of the project file + type: Path + default: PathToAtomicsFolder\T1127.001\src\vb.xml + msbuildpath: + description: Default location of MSBuild + type: Path + default: C:\Windows\Microsoft.NET\Framework\v4.0.30319 + msbuildname: + description: Default name of MSBuild + type: Path + default: msbuild.exe + dependency_executor_name: powershell + dependencies: + - description: | + Project file must exist on disk at specified location (#{filename}) + prereq_command: | + if (Test-Path #{filename}) {exit 0} else {exit 1} + get_prereq_command: | + New-Item -Type Directory (split-path #{filename}) -ErrorAction ignore | Out-Null + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1127.001/src/vb.xml" -OutFile "#{filename}" + executor: + command: | + #{msbuildpath}\#{msbuildname} #{filename} + name: command_prompt \ No newline at end of file diff --git a/atomics/T1127.001/src/vb.xml b/atomics/T1127.001/src/vb.xml new file mode 100644 index 00000000..b3879d26 --- /dev/null +++ b/atomics/T1127.001/src/vb.xml @@ -0,0 +1,26 @@ + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file