diff --git a/atomics/T1221/T1221.yaml b/atomics/T1221/T1221.yaml index c46bdc8a..631277c1 100644 --- a/atomics/T1221/T1221.yaml +++ b/atomics/T1221/T1221.yaml @@ -2,6 +2,7 @@ attack_technique: T1221 display_name: Template Injection atomic_tests: - name: WINWORD Remote Template Injection + auto_generated_guid: 1489e08a-82c7-44ee-b769-51b72d03521d description: | Open a .docx file that loads a remote .dotm macro enabled template. Executes the code specified within the .dotm template.Requires download of WINWORD found in Microsoft Ofiice at Microsoft: https://www.microsoft.com/en-us/download/office.aspx. Opens Calculator.exe when test sucessfully executed, while AV turned off. supported_platforms: diff --git a/atomics/used_guids.txt b/atomics/used_guids.txt index bfc6bc36..a2d4083a 100644 --- a/atomics/used_guids.txt +++ b/atomics/used_guids.txt @@ -673,3 +673,4 @@ f400d1c0-1804-4ff8-b069-ef5ddd2adbf3 9d0072c8-7cca-45c4-bd14-f852cfa35cf0 bfe6ac15-c50b-4c4f-a186-0fc6b8ba936c 51005ac7-52e2-45e0-bdab-d17c6d4916cd +1489e08a-82c7-44ee-b769-51b72d03521d