* Added ExternalPayloads dir creation
* Created ExternaPayloads Dir
Created ExternaPayloads Directory using powershell command
* Added External Payloads Dir
Added External Payloads Directory using a powershell command for all Procedures.
* Fixed ExternalPayload directory creation
Fixed ExternalPayload directory creation. Got rid of the Split path
* Created External Payloads directory
Created External Payloads directory for procedure 14d55ca0-920e-4b44-8425-37eedd72b173
* Update T1003.002.yaml
Added ExternalPayloads directory creation PowerShell command for procedure 804f28fc-68fc-40da-b5a2-e9d0bce5c193
* Update T1110.004.yaml
Added Powershell Command to creat ExternalPayloads dir for the second prereq for procedure 4852c630-87a9-409b-bb5e-5dc12c9ebcde.
* Update T1110.001.yaml
Added ExrernalPayload directory creation PowerShell command for procedure 59dbeb1a-79a7-4c2a-baf4-46d0f4c761c4
prereq 2
* Added ExternalPayloads Dir
Added Powershell command to create new ExternalPayloads dir for procedure fad04df1-5229-4185-b016-fb6010cd87ac
* Add ExternalPayloads Dir
Added PowerShell Command to create new ExternalPayloads directory for procedure c6f25ec3-6475-47a9-b75d-09ac593c5ecb
* Added prereq download directories
Added powershell command to create prereq download directories for procedure 6f2c5c87-a4d5-4898-9bd1-47a55ecaf1dd
---------
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
* Update T1027.yaml
This test is intended to closely emulate Gootloader's patterns of execution - launching a js file through wscript after being unpacked from a .zip.
* leave prereq files in place
---------
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
* fix: Updating atomics YAML file structure to align with the new JSON schema definition.
This also fixes some white space issues and general line formatting across all impacted atomics.
* fix: One additional change needed
---------
Co-authored-by: MSAdministrator <MSAdministrator@users.noreply.github.com>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
We were having a hard time detecting this one because echo is a built-in command. In addition, this test has no cleanup. Added both cleanup and a bash/sh command
* T1027: Add generic command-line obfuscation
* remove guid so a new one will be auto-assigned
Co-authored-by: Wietze <wietze.beukema@pwc.com>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
* Updated format of input_argument types for Url
* Updated type for input_arguments to Url (missed)
* Updating Path type for input_arguments
* Updated String type for input_arguments
* Missed a few Strings and Url types
* Updated default values for input_arguments to align with their types
* Updated Integer type for input_arguments
* Updated formatting and spacing of atomics
philhagen-rc