From 6ea5be5e96fce771fed25f961c19fd4c748e7eac Mon Sep 17 00:00:00 2001 From: Andrew Beers Date: Mon, 27 Jan 2020 12:45:33 -0800 Subject: [PATCH] remove document and test (#805) Co-authored-by: Carrie Roberts --- atomics/T1193/T1193.yaml | 10 ---------- atomics/T1193/bin/PowerShell_IP_Doc.doc | Bin 11951 -> 0 bytes 2 files changed, 10 deletions(-) delete mode 100644 atomics/T1193/bin/PowerShell_IP_Doc.doc diff --git a/atomics/T1193/T1193.yaml b/atomics/T1193/T1193.yaml index 7646a522..9401b3aa 100644 --- a/atomics/T1193/T1193.yaml +++ b/atomics/T1193/T1193.yaml @@ -25,13 +25,3 @@ atomic_tests: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 ($wc.DownloadString("$url")) | Out-File $fileName } - -- name: Word spawned a command shell and used an IP address in the command line - description: | - Opens a word document that will run powershell and perform an nslookup on the IP 192.168.1.1 and a sleep command - supported_platforms: - - windows - executor: - name: powershell - command: | - Start-Process $PathToAtomicsFolder\T1193\bin\PowerShell_IP_Doc.doc diff --git a/atomics/T1193/bin/PowerShell_IP_Doc.doc b/atomics/T1193/bin/PowerShell_IP_Doc.doc deleted file mode 100644 index c8695e4083e9cf65b1a7e6fa09f396a8ec6ab680..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 11951 zcmeHN1$P}evbJMphM2FJA!a*fjv;1djF~ZJW@d_+DQ0G7hM1WlX7;-?yZdG)v+wF6p|KJg*jUTbzJqTZVw_+kRW<~)N@iH$!L{%TX93Ts z3LAGB<6ueSqE$>$Lw+}38DztnBA0ALD$__oS*lN(Or^?VVb1GfiRCjGEFAfV8vK3Z z(+JY3qMTbce+~~d0gPmZ*YjyI$BKsEuC5XXkI0tH-4AB1IfCj2#XJlc|K>u6$ zU&H(lw#GkwdRc6jSq~#T|GD3b-&C92k1p(783u#NW$Yy=XblM|wB<#!h1Zvli;M5H z4)w%Frf1?N-R#pv9XH~&E^rc+5JKBv<{z|sG@e>rKoSC4^O;=cZMNXk_HK<|hDju- zhW*0SFhVDAAY<->lgB#IcBzGLcMIW6iK!-L4M=NpGi{X??vg#3vr?Gm=FP-4zCxAo zh_nadH;=#fgf-^-p2SQS9o4;7t<|e|6xaA6!i?&M7RQ2-fh;{nzYG@VqIK%XEw`hv zFC>5#CL1P%;mO@t6IK0nKXmUsAKN)VtyX8#8aG`_;0oxb{%#*K(<9aBU?3pja3CNk zz(H}gwlicfv^H?G1bVUG+*euRkkv9Ha^N|{BclIV2xcXQKGfJWQBaORTqay<4yLLm zzr6BF;kj(suCOT)O`B}q;KLrFS>RURF7wD#By|Q%yWO+>gg`tRiqS_k&W_CX3_AQg zggumTh(a2Z&vo`qug`}$@FW7TqD=zc8(g$xYMjMP9~`u#<%g?yP2S51hApO}b!nmu zywA3xQrv;eJXhi=2G3Ua>o6a6R^>*B{D_n*0-L03;iHh0r~3YJh3PpCz7xoBXcJ<9Dh1QqD}I` z|IB`)?9>UkOnWhLEr0gNIY+oB#}SP=@iNJ;96mk(xVp14TeYM|1$XM~a&~ zO_#eS9SlVq#gUpBm{Nz`W};P`^x;9ZeuYYIFf!32+-ZHz)AX&IqAInFy8`@$i7ARI z(T0=}b&W!kvUNxRWe3@pg?|pKiq0LwFl=0{M@f$)r_JM&VxY}juxAC{gvQ!f#k+#XBe!kj@8L&Zc= z#cVjNlZE(WA>x6fe#tfi^WMfxiU{Gz_PKXQg@itVS^sJCK62%7gtdB)Ri8QjH zD-^`#jY`oU4an?XhHXfC=U+Wa@^vj~hHIWin7~HQxorc6>Wyp71@85BnLY+R2)?c_ zBFsVZJiHqI^o1+0O-x0-(p{=#&a=z-`07K&@$;D|Sy?WB@*7=YgjI_BKmsEuR1IHw z5S9l z`5aJSFbFio|Lm(Qb_BTQ0)wG|SHENrI&KeH!5xcFfaUoY5D@~tB3hWS>&=czaf#ze z-R29sie&of#N#@K}s^vm_ZJqWtz)`jsIqwH?Fk684=x$h?=$WbCU@Ms~ho z4K{LW0Vw*-WO4p44otlGx$&_OIy;J z+gIGFms#4ORh>CQ|5{Jje_oYr->5d7{WFrLtpP3S+W{ruGq2mjztx)hYm?+@NDz=A zA`lP^pfdcfH4a~lER7g`FPVN@d{5LQ!*Ior+o3KA1Di(N#t!t#Sf|A=%@^3#>inYG zVC6>0Z)$>f^XVI7KCT&-H9bMsFFx0j5#8ZV5Yn2jneXiY4KI! zYcF|iE@^INvEST!N#+tuhU<=v)ZkIE#ZM1kOeWPEX!BsCtW}igfqHy@^(oF}#3Q@&gz zii9SG08>#LQ%W?76Jq=)XOnz){!Ja?032+&_DV$qAwh$InUY6TI2744JirfIy$mL9 z-p;%HV_8yCDTkHNSNjoetYLEiHJqWnozP1|yasG|AuHWLPfuOe{)2XI%X}rMqSZF! zn1I2g>hTN+3r?4e0)4@_G2KPtA|9osy2D-Ci`!i1{`Eq`g_e#7d@E$Wv^5+b9%KrF zeOB$E_2!Fq%L4n2x$F-Mi_NqIt95f67lcqsi2{v-(Dfpy($xw8nka+DrsX;=o4KS* zAoYF@O~PkGxw5_kf^8v?FZ;w2sABZSF217PaL8mq=^QPj;Y1h4lzQ(1Y3hcnHLWVrBgLdpSs11Kai#?{-}5am{gmq&eJNl}>{?$=Kv15rA>kB&{Z^(#j4 z{;o~zd>&U5GYlCWUQa*A;;c_yVg@>1cS{$%o*#6M@&%4tOe(+eeZ6^E@OpXfeRpo> zkQ_u9jSaWY#p`7C9h>co8VKR#T^vU+@{puMoNN|2)q6NMA`&nU4*-~)b^(NaOP5aMod76WzNs|oCgwBZjF9&(kAW=e1l*dU!E*EL^VF97(X;SJE zj930ey!W7F0cY((RhwrG-%gjK15ZG6jQ3WYNEw+YwtZ!g>#5E!7sbD8$&^h^r3Hz8 zIoFq(V!|;vS!vhrsY%hh3csF%t{yhBs2Ni->@PW@P~|Vr3&jmH2w@a-A`B|?o>t0_gr>eTq8i=z$-xAT67SaW)ADtMa!ng>)fuN ze{T(HaN{n~r}uTdo|Au8l?W~w3|uLYZq+w<^HoY1pMs99VOV-pD6J{GRqnc%)YTlK zR_^JZu=3Uic6$!#Gu`4$vGYl1oFbRVkYP81s0M0hq74CQp0iT_br2BMTXT|B7E=Ec@C!3x4H{?(F70MHDz0A9F|BnPNISs zi@4RlyhNK~3fMQL`@nHdTLv*dK*UUW`WshCDODne<{!y&Fq3E5O!p|Sn)!}z^RUT? zmCnuCOC$4tzzym)XGJthl@h}pI{{r&Z#xTk6gUp`j`bi!ZR(Rkb%YDqGrOQ8y&jhd z5Lxcd$)Cllp45@7?A+ZUx)EQwlNUv{LY_9*EmZW}T~)Yqh+!JDT%cVxr>Q91HuV#x zUy(v>VhrE7T*Tuw(rI8$!nuy8syAiPAnaM74zbvQOikw5#~#;Qg<>UPIc`L|9|9k9 zfqe8IRtyf57{DLO&*meo8EuUAAk9H9D4c#75Y|7FMHMRBU*(Sr*QlFU{Q4|BR7dkI zbN5{DBTU@G?!wsFMlB&T@=tvuR_z ztTCn{QEbX(Jr-Y1*aSs=jq<@Tv)l2jG(`i_n1j8Fu~$<{k1Xe5Z^PMgz^pL6DW)dT z(R}TGRFw13zN(Syx^6~oA~ENBN)N={7-8JraOcLIIq zZUSRSpAr)JC|w;Z<;@;e-HMN&ZjL%Dl^@%F2r-6+Zx;VoFl z909LG1_{D#^G&BYyn4PUEA%Jr+?<1kANd6;rH*aJ4XhW@$>rco9GrFCQ$V6HZ z6T)~Dh>g%T8KUFyofqHQNksZ(n9;{WTNigcoY(QAoWEn^Bh}!9A9OU1F&v z-(*lfuzz+UXRo&6M4A7J_obT%l4>-O8g1$R%?Qi}SHg*pt2eTys9|E7IkF`QhfggX zEt6SReZCjFk!W1sTM-X`pCLHYUB~;}M))(tp4yR0VN8^c7^AxYV=*!<+308jl09yf`~hU^p*6d zwPmc(0~~57E_&%WAFz#fLj`q1fi}ia#yyQHV{p)?_Qfx~*{(Ug%evE9iA$^{pJ*^B zPm%GqRvBgIHS**vL+CL|d@KP0bFm^kv~ST)pb>Ugx^TQ+4TmMyW# zjf3ja6B8ZG7i%>?i$~7!C9ow@^{br@X-|D($iQ``tqsX93g=Z}!`ofGh_ET_nDeW-57I%ptC ze`0hA^u595JB3^;@$ChRfa|?MT$XFEPkQR^Zd-OUK?mz~7D_>9tnyl$A_=q;eqDpb8h@W)QEfGrXS%u210LunuwW2_AeenuV`B60>!a=~s>7Fyu>0Q_SL| z(L~ub(wfZct9mXDH`wQlv8%EN0`d3Qi<~IHPOCVE1Ld4@*h8zQ*9di57EVfG)sn zA4KoN<7wVE;IQ2jNXz!KIAzuf;xxKR2PFv;>_NMk}lGQSi&&cUp$3vh%Ds-QC@XlMiVVCL@RhPwc~wt{``>0W9{0(1@xm_|64h z>!Z^nr9;nJUYYxGp1du?Pb#@`KM3itM*4P)<8?eVU(r%oJkzz`fcb~NZ>@&7n{||d zPv&evK#=|wB-=ZQx^{8X@!o2}<*PdLc`gLYsiguAZ4X8_1CBtx+W- z{>p*Bx~}DU&k`CMYXlQVyps zxPr2~B3$Mnk_q)^wPKw;r0w|KsJShnvS|pKK1Ff4_Q*RYr$|u*@^c}%nv~!N6$}-s ziBGtE<4v=|2^jX@DHCh=d23A)D8e-RS}7fJ71XZe$*VDp??AleQT9t@Yc6xGq!dWP zrZ-!-Zz~lmK!Z3s2|)1rh`X2~ar#xoxYB*M8G|IHex_a~$;J0mEFh%}FDaVEo~4R6 z&{ykTRZ^XV5#WV{c3i$MHB?JZdazt;wa{LAqgPVKoVtRc(FdG47_l&6;CMPFV(91b zZI)3^z;>zgrKjyFO`>>a(zsVZO}~@-n${{aDs$x7RbP`k86C)N{#`>CyPD zk=1rB)$Hsrc$bjegxqF@rR;Ux^la;tM&rV_uRF2Fm~3I&^X|(4e?BAIGWT<<`_GyW z_+usVtO2V0FK@8ikUSNqSz}DaJSBX)HRsfxJ41Q1gz1qMYL8=2$IF^Unok!F*Gq}T z>**JYnjxf{DOY_K^r)}q<26sd6vuaOt+m=_Yr#qhhaGoONT-z1BA2IRdvM!QFQ)zB zu%$HN<((0G3vtfUDRr(^X zm1gzaQ6C(%!E$+4`tr7^2w+~l(TW?wcoj!Lhk?#o;zi+3;YBS?;zcC^ZzbT3HijU=xwWS7d?&3`**;q!;iqK zTSQ=0+0PZXQVcEgG^1VJq_KEvW~Ixb9flrL+8NrknyHJ?oB{h-QB>WdlybFTs2P1@ z9cx0seBS12OWMO3Zqxili9BtOV!M&jK9PBj} zNYo4!c{}2Hq*Q>hT8}+g*!xTz)zOR5PW?a%$Vg*Ft=Y+7w~}lWM^zz`qXsv3`5TSj zegulnS|eDxbgYKR|Dal1bv(J{b8-eGa1Qe}5}^HzW@-b)ZeL*;kjm9atO-h|+l%3( zUX65I4yW7KB&(dl?@O&GmODK@MQ)lb$5dl&6=MIQxTpRz_@r(N<-J88uGM$kHfc88 zTAEaMV|nQj{9(gmql zjNw?7Hq@Y+-r$f5(B+2`nig!9EQl+U>{> zDaC<5=>>qyMgskGszMjin$7ot`h>f$+L@k*R z%algq&oR`@lHsD zR4nkd=+oEdDJw@y7JRFFHa#$Q_b}bL*%80@9pDkGoe0(^kdYO63V8_vMj#uqOdJq7A;G17}7>FO!ssA3m`^i)pT>h>_q0E^1GVm)CE5GYaBaq%RtoSKh_;b!S-*mE2; zj3u_ldWzc?Z|1!w%xy3Q8v1yobIJD64sg=Smk!x>i5;kb4vE)JXvFCG+GWkL(Kb}- zQid&Z{#1k6SeqKH?IPjVzCuGKX4+vl6g(6od1?^{3(K~R#lbQ2h5CRcZca#*P37w3 zi3BN^Gt)Re<^7Sk$NKPwxrVs|$Hl7_m*k`=!*;G8=lYRO^`i7>w-HsR5cM|?Q8NH%AdK2QRdsDZAH}tL~myIT*v{wof;>R-) zgYHQq6%^bsy$4d4<)wWL#tR~$R%QB&9 zB;GKl!H!BR*L5GXfS>}@%z0~h6Ha~Q-Vn=*fJOO|i?~R2k3yO2dqI>d2>YW5*@ul< z82E%;mm{~^C0$O>Jy;Gv)>{AK(CeiXH{MM9OFt6BY}w`HX#rK!$h6; zkFNdmMZfpw?_D(ejETrd9X{|Lqdy26LtZc(mg;}|_7BK!e}{{RJ`VoTd#&vnPLacw zQBN$d*_p3>o^J{&()pgv4R$R>FRw*L<$|d6Ruhe0Htxf-#MWGmq1|LlowL0nnlJS zXVnB|q=eonn~8UR;;|99)$h&^EYbzyq|6$ddOjh*{ElNK{VQlNcIsas1Q-E%FsVkM zELv7!M+wWQ91HOX`9+uk%kFgk72gx^EpihIMj{Qn9IzU)Amn5^f%3%E?P@X=7QXCC zH%~#G_b=e_ncDE$s(i5JRfNDE(QBB+ajg`20z0KyzmtHIMCbS^VkD6(zu!pGv)Fb? zK5e$qqFDOqVrc0zbnO527>J!Ezv+Zn3WG`dSDR<~?dp8CKScb$@_!cq?9Ao=zC7bM zI4(XhGyy29gqpUf!$eq%eqXC$521|9x7}9R%Mc2b=Hl)Bi1o4$MvFShGwTeFLSqIa z8DGO=AHSC)OnUz0QhTY7hhbw4P1X5nwpNc}J^p>3><7Q9;>QJ}zA>=Ek0Pu{ky@({ zhJ?6J^|})?MwTM;xyBEt1?CGcN?z8v4P3`ssd7K$Ot?e2pNa?$+F?Dd(p$;{n|T$~ z-o{g2x49%)HkuwHDw_+2;7a8lui)r+5lTDCF<&b`@zNZBc6L6ohg@^#EhkLbkC-@J zIf4jhr%~vz@H8KrS-%mwPK$e81DKLWC!W=-WWk>vI<6*qVd%U<{kssnZ8oBV0(f2# z1w24U|5pg^Y^1O7r(Jsd^qAQ@CS;I}ui59wb_-?l`Lq>+REgT3vQNQ!Ps##~KLF5L zeiT}-n0Z}nX$z7MxexiL&^aCSLJ8OJ&~V~l%6qdbYIIcWEFat1&_Ga}nx75|k==FL zF?F=3))~Q-Vu@3IGmOEQAWQvZB@de~Z^7oB8id}tKNd)Q6yMXRT(tef1`n?{IaE*hx{|CTvbM4~PZb(?n{vMyk8v8$H;A z7c?hkVl_<;<7_X=wRJyHhm?vae|kTYn{Bs87?e%O%*oU$wkY9K;I8>K z)NQvqzC(29NEnK+zsKlm1%Mta@&qFp>KvmUScEw8gVXHWHv+q?*Se|af4jG-ROZR+ z2M%l)Ff)SsuYolN(uWlF^ev2jOMa}xuA410qW7Oec|c`9^;e@6W)v$N%y;UZ=sO@~ zQC8Cx@QI3rq&2L^oaFh*7Fjzn;rd@^*n3Vta3DohipJ$$XQh{$w(G`=)2wJO)faSV z*Eih7^KUp!)YViMP{3T<+Fu>&72%kGA(u7CzL%S!_irEmfSkdChgp$?=@)So2=(!i zjd|sb_qw4wB@?PnK|Mf0nX$eAt>4RkD^(QcVJ^fkhAr=LR5C)?BwK+e-LyySi{I7L z8aDv6$|P4Tb8}dm@!<&8F#ZBj6Ag25^g74C`!YR0W6Ijwjv%Y?U0J}734<~U(ZB>R zTmJE$coX>aaQFP);3Ez5jD7A1(%L{>XHuVS9EN478iBxJJ3lp@MrH0w`KB1UVzjxSRZLm4q$6{wn?wi=}=JYo} zxRq!2F%0^yoFv7_1{RnUm7PDw$@jKQ-?_>sVg-nZkjilFk%*CwlR=%2ib7SSyU2;Y zdjLRP&b+r;x6RWvcgPXu%V8c-i@fj6*cCr{8;)sty8OoRVGQ!2;s<>zH^7$ubp|Gd zt?B`o*ZTX8)}x9k*$g=A>p*it0Uj0tPY7l0tZnQW46N;bpL8HA<-aF{KywI>)%x7c zh#q(@{fs1e-cXMWProcaYeNrb-i|=J-X^Zysm38kqE15?Vy!4YK4I|jtf&hH0k~ad7ydb-d;c@o>bJlVdcOOMyR7pJ<^EFNL$o}qzy zw>X1O7YZMvmCIzl{8@w@wO7bv@2#9&9!zZM*+0BK6d*lb@5Jo`-HLB(qP_0=jhDAP zi82k@jZhvZb}4mS|3ehagT*|~n2vX!tB)7jp`p|XXa@5(L&^(ql>e@v!XYF@lRyQX z1*$LdpA}Tk#^$$0>A(6395&#UuFwVK#lW{AE%ISEvwv#NId~`17p;GwrvcV$Igu_! z(GARFE@mw)MAhSdUUEwPd>%79gC|8bygYtYa}k5?vh_Cz!3*v6bH0dG8+94vmJ557ZCbS!XDZDOR1g zuZXoDv$CU0EW9oi8ANXIKisaWhk%j7W%jDF#e%jZQyu<@H8>4Hs-mU&-gYD%xzTDv zy@k(Zw!T$JJ&69c;YZXSaLima~V(BW$&K7cidcgkDV9O&0b}$;ci%7^W1EC(yrJo zCaL1Oyy-%JTn_Q+}27D@EZCSzPe{2Vvn?5x*Yr{2_u5 z?Vlq4eBARZ{MY>NA8;Muy#4+ye`JGy1^*hk{sG=1{wMgCIQCZwzlLakNZ=;@r-Z)* zY`^0F>g@kO1Gz%vARvEp{lCKhx)lEzK27;2_&*nBSxE?>di=(6g#+mVMi+}Tzy13k D_)=Ny