Created
November 8, 2023 18:22
-
-
Save MHaggis/3f92d15ce018e12b3564817f7118d11e to your computer and use it in GitHub Desktop.
You will need to create the T1059 folder in Atomics directory. Save this as a new yaml in that dir. A second folder under T1059 will be src. place the au3 file there.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
MsgBox(0, "Atomic Message", "hello from Atomic Red Team") |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
attack_technique: T1059 | |
display_name: Command and Scripting Interpreter | |
atomic_tests: | |
- name: AutoIt Message Box Test with Download and Extract | |
description: | | |
Downloads AutoIt to the temporary directory, extracts it, and executes an AutoIt script that shows a message box. | |
supported_platforms: | |
- windows | |
input_arguments: | |
autoit_script_path: | |
description: The local path to the AutoIt script to execute | |
type: Path | |
default: "PathToAtomicsFolder\\T1059\\src\\automsgbox.au3" | |
executor: | |
name: powershell | |
elevation_required: false | |
command: | | |
$ErrorActionPreference = 'Stop'; | |
$autoitExePath = "$env:TEMP\\autoit-v3\\install\\autoit3.exe"; | |
if (-not (Test-Path -Path $autoitExePath)) { | |
iwr 'https://www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3.zip' -OutFile "$env:TEMP\\autoit-v3.zip"; | |
Expand-Archive -LiteralPath "$env:TEMP\\autoit-v3.zip" -DestinationPath "$env:TEMP\\autoit-v3"; | |
} | |
Start-Process -FilePath $autoitExePath -ArgumentList (Resolve-Path "#{autoit_script_path}").Path; |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment