diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index c7d06cda..32b7aff4 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -43831,6 +43831,15 @@ execution: description: Location of the payload type: Path default: "%tmp%\\T1106.exe" + dependency_executor_name: powershell + dependencies: + - description: "#{source_file} must exist on system.\n" + prereq_command: 'if (Test-Path #{source_file}) {exit 0} else {exit 1} + + ' + get_prereq_command: | + New-Item -Type Directory (split-path #{source_file}) -ErrorAction ignore | Out-Null + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1106/src/CreateProcess.cs" -OutFile "#{source_file}" executor: command: | C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:"#{output_file}" /target:exe #{source_file} diff --git a/atomics/T1106/T1106.md b/atomics/T1106/T1106.md index bab0b3ad..927732ea 100644 --- a/atomics/T1106/T1106.md +++ b/atomics/T1106/T1106.md @@ -51,6 +51,19 @@ C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:"#{output_file}" /tar +#### Dependencies: Run with `powershell`! +##### Description: #{source_file} must exist on system. +##### Check Prereq Commands: +```powershell +if (Test-Path #{source_file}) {exit 0} else {exit 1} +``` +##### Get Prereq Commands: +```powershell +New-Item -Type Directory (split-path #{source_file}) -ErrorAction ignore | Out-Null +Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1106/src/CreateProcess.cs" -OutFile "#{source_file}" +``` + +