Skip to content

Instantly share code, notes, and snippets.

@MHaggis
Created November 8, 2023 18:22
Show Gist options
  • Save MHaggis/3f92d15ce018e12b3564817f7118d11e to your computer and use it in GitHub Desktop.
Save MHaggis/3f92d15ce018e12b3564817f7118d11e to your computer and use it in GitHub Desktop.
You will need to create the T1059 folder in Atomics directory. Save this as a new yaml in that dir. A second folder under T1059 will be src. place the au3 file there.
MsgBox(0, "Atomic Message", "hello from Atomic Red Team")
attack_technique: T1059
display_name: Command and Scripting Interpreter
atomic_tests:
- name: AutoIt Message Box Test with Download and Extract
description: |
Downloads AutoIt to the temporary directory, extracts it, and executes an AutoIt script that shows a message box.
supported_platforms:
- windows
input_arguments:
autoit_script_path:
description: The local path to the AutoIt script to execute
type: Path
default: "PathToAtomicsFolder\\T1059\\src\\automsgbox.au3"
executor:
name: powershell
elevation_required: false
command: |
$ErrorActionPreference = 'Stop';
$autoitExePath = "$env:TEMP\\autoit-v3\\install\\autoit3.exe";
if (-not (Test-Path -Path $autoitExePath)) {
iwr 'https://www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3.zip' -OutFile "$env:TEMP\\autoit-v3.zip";
Expand-Archive -LiteralPath "$env:TEMP\\autoit-v3.zip" -DestinationPath "$env:TEMP\\autoit-v3";
}
Start-Process -FilePath $autoitExePath -ArgumentList (Resolve-Path "#{autoit_script_path}").Path;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment