diff --git a/atomics/T1218/T1218.yaml b/atomics/T1218/T1218.yaml index f31f11096b..8f17e5b79d 100644 --- a/atomics/T1218/T1218.yaml +++ b/atomics/T1218/T1218.yaml @@ -313,6 +313,14 @@ atomic_tests: description: Path to ie4uinit.exe type: path default: c:\windows\system32\ie4uinit.exe + dependencies: + - description: | + ieuinit.inf must exist on disk at specified location (#{Path_inf}) + prereq_command: | + if (Test-Path "#{Path_inf}") {exit 0} else {exit 1} + get_prereq_command: | + New-Item -Type Directory (split-path "#{Path_inf}") -ErrorAction ignore | Out-Null + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218/src/ieuinit.inf" -OutFile "#{Path_inf}" executor: command: | copy #{Path_ie4uinit} %TEMP%\ie4uinit.exe @@ -364,4 +372,4 @@ atomic_tests: reg.exe add HKLM\SOFTWARE\Microsoft\Provisioning\Commands\LOLBin\dummy1 /v altitude /t REG_DWORD /d 0 reg add HKLM\SOFTWARE\Microsoft\Provisioning\Commands\LOLBin\dummy1\dummy2 /v Commandline /d calc.exe c:\windows\system32\provlaunch.exe LOLBin - name: command_prompt \ No newline at end of file + name: command_prompt