Files
atomic-red-team/atomics/T1127/T1127.yaml
T
2018-05-23 17:09:04 -06:00

18 lines
488 B
YAML

attack_technique: T1127
display_name: Trusted Developer Utilities
atomic_tests:
- name: MSBuild Bypass Using Inline Tasks
description: |
Executes the code in a project file using. C# Example
supported_platforms:
- windows
input_arguments:
filename:
description: Location of the project file
type: Path
default: T1127.csproj
executor:
name: command_prompt
command: |
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe T1127.csproj