T1137 - Word spawned a command shell and used an IP address in the command line (#610)

* create document and test

* update default atomics path

* refactor tests

* change back path

The PathToAtomicsFolder path works when installed from the script, but when closed from github the folder name is different. I think we should unify these and just have people clone from github if they want to use it, instead of having a seperate install script.

* removed duplicate, used powershell to launch document

atomics/T1193/T1193.yaml

@@ -5,7 +5,7 @@ display_name: Spearphishing Attachment
 atomic_tests:
 - name: Download Phishing Attachment - VBScript
   description: |
-    The macro-enabled Excel file contains VBScript which opens your default web browser and opens it to [google.com](http://google.com). 
+    The macro-enabled Excel file contains VBScript which opens your default web browser and opens it to [google.com](http://google.com).
     The below will successfully download the macro-enabled Excel file to the current location.
   supported_platforms:
     - windows
@@ -17,11 +17,23 @@ atomic_tests:
         return 'Please install Microsoft Excel before running this test.'
       }
       else{
-        $url = 'https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1193/PhishingAttachment.xlsm'
+        $url = 'https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1193/bin/PhishingAttachment.xlsm'
         $fileName = 'PhishingAttachment.xlsm'
         New-Item -Type File -Force -Path $fileName | out-null
         $wc = New-Object System.Net.WebClient
         $wc.Encoding = [System.Text.Encoding]::UTF8
         [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
         ($wc.DownloadString("$url")) | Out-File $fileName
-      }
+      }
+
+- name: Word spawned a command shell and used an IP address in the command line
+  description: |
+    Opens a word document that will run powershell and perform an nslookup on the IP 192.168.1.1 and a sleep command
+
+  supported_platforms:
+    - windows
+
+  executor:
+    name: powershell
+    command: |
+      Start-Process PathToAtomicsFolder\T1193\src\PowerShell_IP_Doc.doc