From 751a827e86d514cd7e92d68cb21bc0ac7cd56e48 Mon Sep 17 00:00:00 2001 From: Dragonlord0 <68132170+Dragonlord0@users.noreply.github.com> Date: Sat, 15 Aug 2020 18:14:34 -0500 Subject: [PATCH] T1218 (#1197) * Added T1203 ProtocolHandler.exe * Fixed numbering error * remove white space Co-authored-by: Carrie Roberts --- atomics/T1218/T1218.yaml | 29 ++++++++++++++++++++++++++++- atomics/T1218/src/T1218Test.docx | Bin 0 -> 11304 bytes 2 files changed, 28 insertions(+), 1 deletion(-) create mode 100644 atomics/T1218/src/T1218Test.docx diff --git a/atomics/T1218/T1218.yaml b/atomics/T1218/T1218.yaml index 944beab5..f8a2adbf 100644 --- a/atomics/T1218/T1218.yaml +++ b/atomics/T1218/T1218.yaml @@ -94,4 +94,31 @@ atomic_tests: executor: command: | InfDefaultInstall.exe #{inf_to_execute} - name: command_prompt \ No newline at end of file + name: command_prompt +- name: ProtocolHandler.exe Downloaded a Suspicious File + description: | + Emulates attack via documents through protocol handler in Microsoft Office. On successful execution you should see Microsoft Word launch a blank file. + supported_platforms: + - windows + input_arguments: + microsoft_wordpath: + description: path to office folder + type: path + default: C:\Program Files\Microsoft Office\Office16 + remote_url: + description: url to document + type: url + default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218/src/T1218Test.docx + dependency_executor_name: powershell + dependencies: + - description: | + Microsoft Word must be installed with the correct path and protocolhandler.exe must be provided + prereq_command: | + if (Test-Path "#{microsoft_wordpath}\protocolhandler.exe") {exit 0} else {exit 1} + get_prereq_command: | + write-host "Install Microsoft Word or provide correct path." + executor: + name: command_prompt + elevation_required: false + command: | + #{microsoft_wordpath}\protocolhandler.exe "ms-word:nft|u|#{remote_url}" diff --git a/atomics/T1218/src/T1218Test.docx b/atomics/T1218/src/T1218Test.docx new file mode 100644 index 0000000000000000000000000000000000000000..600965ee6962c3ba4c17ba7de4e83221407dad94 GIT binary patch literal 11304 zcmeHtbz5A?_I2YP+#P}j_k@N9g1b8;NTZFrI|=R*+}(ncpdq+xaEAmBn&59IbLUPb zbKl<=xcB^Vo<3Ez_Ni07c2(_FTUibc9uI&BKn4H+)PU83Nr)~C06>KR0N?_UVfCKd z**b%5onNSX*n^!6*xYR(RC(~Qj5z>UX#4+N|HUIvpEzXufdfn8ThcXVT$6_Jm%K7& z*a+cdR@Gf3A}?6YyZFA=`*vJd6%Cj;R0s_n_qP>p&EBAig)|5Xc7q$;KA})@K!Twq z|C9MoTdaPj#PsWl94n#&eEtxg);3~!J{S(#hVJ+gHB_aH{EQ%c?eBnS=A;$n)?ME*6Jgb0+XtQC!P;7sYvqw=J`m!`wyueC<>+(D6zRnj>#0aMgkE0tQd?h52}_t8EVBX$Xg0a zC20mqS}&u-S-|CbT#oI`Eo6ijj5?gdSmtkndRM9;m7|tx0M6YhKZA7XS@SWZ3!5Af z^8TI08=LQN0Kmfo969Uq+@RcN410%c*W%kOjTkodT9gq~#TFB`>Yrlb>zH@1IH%KePG#C`2gC9Odf*AMx zb?Qhb?l!ad<#sWeB@NTqw8`VT{458JPv25~xpUrd&dgd#>v1gePVVmrKmm<#j@72-X~`! zihHSNXb8y~w^Edwz6cP{6Hp!JeASR>`izVRESw|99u*U`!_%vYXk+LS;h6Nu*`gh7kyR?Qb)kf?M)6hDkLL-g>#`oU za78C*f20`VgTLMvyrQve((Q5#KYZh{)6kc-1R?{klQ+MGRX=#O+4-&6I2Jjn=YEWG zRnlp-F1jq3Ajkb6yZM5WfD*Knq5=zHZ*iocNsN*mF$TFQN(E~tJINesqndS!?e(HR z4&cF$Ou&&BqZcKbrnT{Ru;yHiFN16FjWFpOvIxtiL)7YIGJ47zP3a}+&TA^!9(&b6 zb>(TD(;{YqDyjNPEdg6*#I{eS87cK4bL^Y(?!+6Je7Ms zPIR^s=@0=aeVX;-j7%JvkUiXveG9}_q@z`E@`f-+EFF(Ht+795nLhByW-e=PHw3gD zS#IzxBrIg=Xmq>_oLNa;$7pN{o8MC3R7+;@9K<7f$Eu7yyV8B?;eyb*m-HR&ph!QFvaN$K#6XWHb=$*2=?{!0N#OKViw_J~iu6;@o=0!ad+TyDzdEi*b@gZG&ER8` zG;P^0*0XOe;!f|Q@Ao$#76v_+6&k^5eI17q`TX8pW^m}^3OK9F{daW*pY@o^POKzxQL6W-+H zbGWt(Wmz~3p7Tk{y4dj|P+okmNerY#?%ku{N#2T!lh$gAw(4`~%@)r?mY!LZ0`#~F z>rYhzjR3;jsOzc^{ca~TYWi?f#pLG9A(+mG!DqXM z4TEA6=yUj7A#c8r;-`sNp{%iWWby00csVpNNGOe}X|zUpEQrBgOMN9VMhfz#@KqHGAUUDJzR zb<-m;48V!39Y9<-NsG!!J;dRn{~n6HasY7 zOpvX#P81AF2#A!#(?McX{P-a~Fp^{9U^+8*3hQCJPlFC0y9P;g;F%rjykx?b$=ldG zrsIWd)M{6h)9ab?GY0mt>|4+K^WCe2Y(f*eg=K(_exuh-x0avK!_xIx%JHi3%|fI( z_%=Pe-TiFw_+cx{y1w1xWM@0#)2i=PU(6V~eRiM34FfoTA+Td-2tg z4FQ-E$htWv9C0ik;<-Nq$@MJR%a@%OITU?2>ir=o?mm~wwBCv1#8QZBBadhNUj?sG zDf=)z8#(y$eu{OKAzq>2D%P@4nHDd6{q{44jBFwgW&M zQQi{t?!W96wK7Fl)t96IWTi?|j98W+WH`j_5*Zs~(DbJc?C@n;JKLeY;Vizx8dD>e zd773Qi{u~6RjWiV3OiXE$2}O&b&1P|Er+M=hRh#Nb^R#LB@QXpM&X+ee1r3g)}~_= zVlH;9dG7ooR+zAM%FpiTIgW+~Qx|w(!tmR)R9cg+q_zglaALIQ>-(;h!?l9S5PZ0Ezxn$YjSpwFZ8o4|!wRkI3bxZ87lRg=rj_MB ze*g7}=HrKZN=QWl~DU*(&O5(^gtJ&$f z!@==vK6{3c$AYqXE!%*&;vyZ;$}05>}cc34=++2GSJp1i!3?D^IzX|pzy;ah#L4Ijc_IWp8o z5&oGN_@dQE<&f0w<>W@158Y$Sq!KTC4dQZsj)v|y zu6>WzI!$~_t3C4detl^Pc>kzrGM(l{>F@I!8DBF3CTrMj)Tp=)G7_D~;VOA14Z1I`)?6Gq@Ky7}MFnD0kh2J`zHC^3Ib~Np z{i4j6XU)hPDV^L?3ddooJamAlQJ93Peu+%eGVIm7LLFr#=Ul3cp`k5p)L<%#In+^L z(1~ZksA{)vZY+?r>>UsyLT2p6$!#5G1b8G-zI!F(jJR@R;kkEeEroL#P?QSMSCsWK zHAU!3IY(>3{{GyW1wj(@6olRN4VLPI$33#f5*fY@wyB=<6uaZjlefm|m8G+)t7zyh z_ux^BDJ+afjJ2j1htC^;-+>(r$lWCOG99~?q+P0g^kl*^mO)m@m2B+Cy;=qZkH}+t zjCtBJeb9&@ljgRD%?;n09x;4k#6D&rc&(L|XK_eivd6=G=PoDF`2-eDRxz%&5;pZQ z`AY#~2tooL0A$$OIbA|$dHbd^Zsk#HTj+feUeRSYcS^cN-otdQ2D#_Bv$y>GtZytutQ~T-ocL+W0cq&&Bz}5DoT|Z? z`r-u8%=vvCt(F-YKl-YYUumO9%r?c4;P4COLqo)cJEPcbQP({FN3|zZ>G1QWu?j(u zXZ>cPd``9G^5tggK(U+9`~?1ZP7kW@cm5qXE;1Z~1^u;)72}4rxaZ}w;x~c7u1EB# zy5IHk7$J^@pvO zWDEiS@aLuYF{@1utls00_Mq{$w+A0Bt@rTWEq03S<~mb~sF>=h`$bBIr8lj{9hhR~ zj_Y665Fqc8?iRlpJNx?Gl4o8Hb8tRwhg&kN{)0`DjrH}7kB^fS3cPKTzTgvU&sY&k ztxsB*&u0Wk{nvcZlCXIX#lDoYz)i?>8|`>na?T0Zxp!9Dad+SKRdryGo&!swCYi}< z1K-kRa@-5zed3Yr&sIE$tfyWcYn_&MCU`c}9mnVWicg^9uniXnV9n>bMO<}&lE6MH zB8hU`$!iqaBTr0+XE>&#OMFMDY>3D>3XqFUp&mqu>+0%Pl8r3!ZJ70FpOF3#k8CD^ zlUh}jEfYHE7_?5QUmm5!H14!7vO~1!WT2*5!~4V`+N5j8p-2bF`0Pkjvfn*6%CS3Y z@>M=+5G)Z~8)}~5p4X9vybXGQ6=zKlM)~ep;M)z4wxaxa6Ib-4p2MjEypziFWu?K} zf|`=oA7vK3w_bmIn%Tu)HxaXso|zD?9neKCYx@bP7j-vad%tmc0X2NGOoWr(1Ev3VU@aLi~9KUWZDG1k?$|C-JcSy(!gdvWKA#?-Z3|e z5JJ2_d?VB&855eMiA7%Nv&3_~?eVmEHasHAnv_v2AG6bwv!gZD#RaLHflqeH>O`$~@EU$@ZjB9eC}gt=c{?&1rh( zVe>ra=ww|H_00VE4C*oeA+TCvi;cH}j$}7W>TcC@p1VmGq4|KTuDh4g=d z4|L=*REHFyf=?^$38u=?G!s(r_$)rN7@4~ahP`2ig7NxXvJKXq*DOXbl|bCoXoVY4 zkh5YHNv&1o^}@VHi@rKoRI^2L(N;rvIz_4&jE%d17*$u#?1neg00jEqtN}v`mpwPR+%{XQuoex@?9rXG36cyT?&JHR?`;s8z$wKaMWn6Cd}YSyXn~V(4;I2YSgp z;M-&j-fx(+omDX87Il%zKejt7fZ@beeji*k3pYSFh3oHiz-VU6vNjMxKZyEKyR)dz zpV`6rO$N2Vw-t+!Fxn)3T?9gd^zip>V>C)Zsgy96?Q|C;&I{nur@_`XmVRB@HRb*W zBCE#(#DSG!&q-Hw8!c!8zSFGKY~Kp3B4lY$CSFM@cfVI?=dmV1+SlvOx7E03_t3n zqaU?srEaxpCP1#4x&JoldI)I@YWn6*Ng0E*dr-{M3TM$>*sm;r5{ncl+uK9`+^#$X zB$4%2oI_O_hPbRNN5|JENi|8ibX`IYVZo6jiyI|DIVrcYfw^mLoHg;IJQ=mV1FMTn zh1><=6EQbaI04i^Fa1EeNbNw<+-gMHXUxRpiB{DSnw^ZHu(DXQYxX!BxYnX6I~$>m zr>|IAD)IHjZ#G08h=lz$G!)93B@7;@@3n6$H;l^yv`f!goWId*^m@@qh7;_|jf}e~YpHT?!sibgp`*{}>wHVh^sQg}5=ivk z+3x*LC&gY}!f2RTLMWV_uM|b&$JnAi6}M%Wv!&PZwmClALRp|H0>+p?#;-x8lq*$v z0xc2oRNo;aWQQP>ArrU<{$3Lk_Ah2U_eEFi(Bb|kQ?qvxahTBn05yB4C<<-yQxJ7> z_JDwYMiQ-=22P9butSdprye>dG`!;aPt7-;juJ11Su1UlW%pZFQRCDq2L%tt%pFy; z15|Og=os0WFOpbQZU7%62s;A{&KHlzN+W$wTCtb~NflO(qiC{vn6c-(=fCvb&Ai9V zFJaV4<|yUzjz8K))tz{$^p09f-bc7T5 z0CNem*1RV0Q6-3oke$hoLc-G9^DMSBW2At7S1sJRk_L^!XVQwE`F{9wMLgKZaL3K# ztkwhkpkG?Sl2@#z`B7|XU)MsNndjmf_~fHB<$49<7+RMuCfhKmQfed5d8HjIj3`PW ztjF)7>xFz))a5s=WBoJ|NE?IBWsPTy`LVD3a+-kM2+udj$5Xc{CtLwr#ftm=jHAI&i(t|XwiuM`*N?ddcGv# z!Ot%=Zu=7~OEEK|AUfA0l>BZj$}N1O^I!5=)jFPTmo^i~eBk~ZG%xn}_H&>)2sI0` z@^CijdcPB;t?}mmVa?RoD}W`QeT?%3$&=lDV(v6=ZkS2$cR1-EY`*(x*2v_G>)i%& zb7zSsd_vaq!82YJ#~Yn*&GGOhz#tpcVre5eKFcaNl^kVZNou$R3kR7?rT180mSQ zw7=wS(c^I$A(u%f#UjHKgOz$#J1E48Gg<5;{Q2pavEuyO-5h${$Xe!1?DG*iFDjE0 z7HZpe{5Vr(Z8wWd5PPHyylAnaPDc5^x(%3WLV}Kt!PqB%*EpFM$X}DX zUK-GYK8DU>=5D-ZAvq(C5mi!1LZTAH%ai9?e#4;g{>Kk%3-QC*@zAElHpW8ojb)9# zf`^smLUl7eZ+oGl4Qdll7!L1umY4GRg2{ESGFS=Y=96su-hGZ_{VYbuJ|WbT(MYdS zxo<<*GHuRUYvmqfJ5e&+u!B8sJwnShm&U(j+~oNNLSXTU=W4hxlS^j? zZDHNkWcw>cBWGt)KN=Tly$OovSN^&TUPskP?{wWq)pMb|OPbYEbd!6$(t*0N_@GJj z?oaG;S^M<|4jj9(GNoDWVp18&EoC=p)>l4HWY~xNWKz&Hk<*{pP+u!ul%wrUue%F`3oUtRT$I+~d*cvEC#;ZIn`q9NN0afN-jOc=XYRO@oegg0jw zH}_Jk7cwIqKPMGfcjCuZ zAZUry(yQ0X)&-tMvc`N3W{tV_MtL8(jSU&lSphl5#fBLfsmp2;C7}~Y76ydGp>o_l zB1hu8<@<3n%p{Slhqr&Jei!L{&G2q;v$N#-O^C_`H(LIlIf3NN*dt*nZ{bf7FW)is zimF~bMUvs4Fr`yUVK%=)!#<7J!i;cYQ^`MB-@JL#M;YS~mmT;vA$xLB%U3+5 ztNrZ7hv9=%(W&I7b}!h-8&~XQ>#f^5)rYuu*?4LW)lVtwH0+P%#3ImT(AvEQ!T2 zR+kq2qa2E$hW*)$*WTtB1CxunASVhH+ag~Kexby*O`x-cgTh>$h!ToG;rz7@D}aw# z{6|y9{J^hN`C_OGCI2eY1z8cben4~h(e(s}zNj)yIUbD5SE36TmTU4Lonu;mn=T8$-LW{fZK7LG8&Ms1~>^B&k zUF1q;tOP=PzdT9H9@i2AkpeB$kpg(bGR=I<(n2yDI%-b0( zhoRD?`dmGA+WzH7Sqv2I(rzSk5Vf?GKS~NoUSMHp2}kL=dT0^}PL1kwSk1iv+*(3h zHePWAD9%W=yN6uUO1kqWj{5H)(d5YFe}Sx|k>g2Tet_C~SxQ|dXZ1d!mX24}h=HsL z*$LJGw-)y`X+~zJKV%^6(Qq=E*vm%v23^bOp=AAu+u-)SD-<8_Ij*v&C#Sp79b^3m zUua*OA*Bj?_W9S)?mEoJYgy?xPBZbc>Fp(wq_AEU_JZYXR5xo2`TqQt|6jGkylVP1 z9D^x4z5bsjPUWJ8k{1g8GVy=f|7oBZGVtWjm%GRw4kY&~>47>;=PtjEoWB}Mq2pie zIs|egOs|SA=)>1jw#v+c5={dY6!LZ$O4FKbLekMfUBdXV2=LjRbsWwPWwP?p>_iPf zy(S%S7cN~{)v^uv^E_R9Qwj;TY$3DRi|-ERb&e-_Jft!!A7|RAm+zFX^%apGmE~5A z$EyOIMlA(Bz%QCN*@MU4>=M2mI`NXePlQ+iDnCR;aA= zpHnJ-#5%uT{~^IrS?=!!{+wnF{r{2<_B-(JnK8ct>!4@R|5u*O@0NbgmiWuo zE;MiSAGs61!+$^i{tK=JjW~Y7e?JWW-Nf%l9eL<4j|bqf`yA5Z@e(2~?K literal 0 HcmV?d00001