Skip to content

Commit

Permalink
Update T1218.yaml (#2596)
Browse files Browse the repository at this point in the history
Added prereqs to T1218#12 so it can be executed remotely with invoke-atomictest
  • Loading branch information
moullos authored Nov 8, 2023
1 parent b01f386 commit f9f938d
Showing 1 changed file with 9 additions and 1 deletion.
10 changes: 9 additions & 1 deletion atomics/T1218/T1218.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -313,6 +313,14 @@ atomic_tests:
description: Path to ie4uinit.exe
type: path
default: c:\windows\system32\ie4uinit.exe
dependencies:
- description: |
ieuinit.inf must exist on disk at specified location (#{Path_inf})
prereq_command: |
if (Test-Path "#{Path_inf}") {exit 0} else {exit 1}
get_prereq_command: |
New-Item -Type Directory (split-path "#{Path_inf}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218/src/ieuinit.inf" -OutFile "#{Path_inf}"
executor:
command: |
copy #{Path_ie4uinit} %TEMP%\ie4uinit.exe
Expand Down Expand Up @@ -364,4 +372,4 @@ atomic_tests:
reg.exe add HKLM\SOFTWARE\Microsoft\Provisioning\Commands\LOLBin\dummy1 /v altitude /t REG_DWORD /d 0
reg add HKLM\SOFTWARE\Microsoft\Provisioning\Commands\LOLBin\dummy1\dummy2 /v Commandline /d calc.exe
c:\windows\system32\provlaunch.exe LOLBin
name: command_prompt
name: command_prompt

0 comments on commit f9f938d

Please sign in to comment.