Compile with https://nsis.sourceforge.io/Main_Page. Be sure to modify the path to where a driver is located for testing purposes ("path\to\your\ListOpenedFileDrv_32.sys"). Compile with .\makensis.exe C:\users\Administrator\Desktop\AtomicRedTeam.nsi or via the NSIS UI.

AtomicRedTeam.nsi

; NSIS Script for Atomic Red Team Tests (AutoIt, T1218.009, and driver load)

; Source and credit https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/src/T1218.009.cs
!macro T1218_009_CS_CONTENT
FileWrite $0 "using System;$\r$\n\
using System.EnterpriseServices;$\r$\n\
using System.Runtime.InteropServices;$\r$\n\
$\r$\n\
namespace regsvcser$\r$\n\
{$\r$\n\
$\r$\n\
    public class Bypass : ServicedComponent$\r$\n\
    {$\r$\n\
        public Bypass() { Console.WriteLine($\"I am a basic COM Object$\"); }$\r$\n\
$\r$\n\
		[ComRegisterFunction] //This executes if registration is successful$\r$\n\
		public static void RegisterClass ( string key )$\r$\n\
		{$\r$\n\
			Console.WriteLine($\"I shouldn't really execute$\");$\r$\n\
		}$\r$\n\
$\r$\n\
		[ComUnregisterFunction] //This executes if registration fails$\r$\n\
		public static void UnRegisterClass ( string key )$\r$\n\
		{$\r$\n\
			Console.WriteLine($\"I shouldn't really execute either.$\");$\r$\n\
		}$\r$\n\
    }$\r$\n\
}$\r$\n"
!macroend


!include "MUI2.nsh"
!include "FileFunc.nsh"
!include "LogicLib.nsh"

OutFile "AtomicRedTeamTest.exe"
InstallDir "$TEMP\AtomicRedTeamTest"
RequestExecutionLevel user

!insertmacro MUI_PAGE_INSTFILES
!insertmacro MUI_LANGUAGE "English"

Var AutoItExe

Section "MainSection" SEC01

    SetOutPath "$INSTDIR"
    
    ; AutoIt Test
    DetailPrint "Starting AutoIt Test..."
    
    ; Download AutoIt
    DetailPrint "Downloading AutoIt..."
    NSISdl::download "https://www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3.zip" "$INSTDIR\autoit-v3.zip"
    Pop $0
    ${If} $0 != "success"
        MessageBox MB_OK "Failed to download AutoIt. Error: $0"
        Abort
    ${EndIf}
    DetailPrint "AutoIt downloaded successfully."

    ; Extract AutoIt
    DetailPrint "Extracting AutoIt..."
    CreateDirectory "$INSTDIR\AutoIt"
    nsExec::ExecToLog 'powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Expand-Archive -Path \"$INSTDIR\autoit-v3.zip\" -DestinationPath \"$INSTDIR\AutoIt\" -Force"'
    Pop $0
    ${If} $0 != "0"
        MessageBox MB_OK "Failed to extract AutoIt. Error code: $0"
        Abort
    ${EndIf}
    DetailPrint "AutoIt extracted successfully."
    
    ; Locate AutoIt3.exe
    StrCpy $AutoItExe "$INSTDIR\AutoIt\install\autoit3.exe"
    ${If} ${FileExists} $AutoItExe
        DetailPrint "AutoIt3.exe found at: $AutoItExe"
    ${Else}
        DetailPrint "AutoIt3.exe not found at $AutoItExe. Searching..."
        FindFirst $0 $1 "$INSTDIR\AutoIt\*"
        loop:
            StrCmp $1 "" done
            ${If} ${FileExists} "$INSTDIR\AutoIt\$1\install\autoit3.exe"
                StrCpy $AutoItExe "$INSTDIR\AutoIt\$1\install\autoit3.exe"
                DetailPrint "AutoIt3.exe found at: $AutoItExe"
                Goto done
            ${EndIf}
            FindNext $0 $1
            Goto loop
        done:
        FindClose $0
        ${If} $AutoItExe == ""
            MessageBox MB_OK "Could not find AutoIt3.exe in the extracted folders."
            Abort
        ${EndIf}
    ${EndIf}

    ; Write the AutoIt script
    DetailPrint "Creating AutoIt script..."
    FileOpen $0 "$INSTDIR\atomic_script.au3" w
    FileWrite $0 'MsgBox(0, "Atomic Message", "hello from Atomic Red Team")'
    FileClose $0
    DetailPrint "AutoIt script created at: $INSTDIR\atomic_script.au3"
    
    ; Execute the AutoIt script
    DetailPrint "Executing AutoIt script..."
    ExecWait '"$AutoItExe" "$INSTDIR\atomic_script.au3"'
    Pop $0
    DetailPrint "AutoIt execution finished with exit code: $0"
    ${If} $0 != "0"
        MessageBox MB_OK "AutoIt script execution failed. Error code: $0"
    ${Else}
        DetailPrint "AutoIt script executed successfully."
    ${EndIf}

    ; T1218.009 Test
    DetailPrint "Starting T1218.009 Test..."

    ; Write T1218.009.cs to disk
    DetailPrint "Writing T1218.009.cs to disk..."
    FileOpen $0 "$INSTDIR\T1218.009.cs" w
    !insertmacro T1218_009_CS_CONTENT
    FileClose $0
    DetailPrint "T1218.009.cs written successfully."

    ; Compile T1218.009.cs
    DetailPrint "Compiling T1218.009.cs..."
    nsExec::ExecToLog 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /r:System.EnterpriseServices.dll /out:"$INSTDIR\T1218.009.dll" /target:library "$INSTDIR\T1218.009.cs"'
    Pop $0
    ${If} $0 != "0"
        MessageBox MB_OK "Failed to compile T1218.009.cs. Error code: $0"
        Abort
    ${EndIf}
    DetailPrint "T1218.009.cs compiled successfully."

    ; Execute regasm
    DetailPrint "Executing regasm..."
    nsExec::ExecToLog 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U "$INSTDIR\T1218.009.dll"'
    Pop $0
    DetailPrint "Regasm execution finished with exit code: $0"
    ${If} $0 != "0"
        MessageBox MB_OK "Regasm execution failed. Error code: $0"
    ${Else}
        DetailPrint "Regasm executed successfully."
    ${EndIf}

    ; Embed and extract the driver
    DetailPrint "Extracting driver..."
    File "/oname=$INSTDIR\driver.sys" "path\to\your\ListOpenedFileDrv_32.sys"
    
    DetailPrint "Driver extracted to $INSTDIR\driver.sys"

    ; Attempt to load the driver as a service
    DetailPrint "Attempting to load the driver as a service..."
    nsExec::ExecToLog 'sc.exe create TestDriver type= kernel binPath= "$INSTDIR\driver.sys"'
    Pop $0
    DetailPrint "Service creation attempt finished with exit code: $0"
    ${If} $0 != "0"
        MessageBox MB_OK "Service creation may have failed. Error code: $0"
    ${Else}
        DetailPrint "Service created successfully."
        
        ; Attempt to start the service
        nsExec::ExecToLog 'sc.exe start TestDriver'
        Pop $0
        DetailPrint "Service start attempt finished with exit code: $0"
        ${If} $0 != "0"
            MessageBox MB_OK "Service start may have failed. Error code: $0"
        ${Else}
            DetailPrint "Service started successfully."
        ${EndIf}
    ${EndIf}

    ; Pause before cleanup
    MessageBox MB_OK "Both tests execution complete. Press OK to clean up and exit."
    
    ; Clean up
    DetailPrint "Cleaning up..."
    Delete "$INSTDIR\atomic_script.au3"
    Delete "$INSTDIR\autoit-v3.zip"
    Delete "$INSTDIR\T1218.009.cs"
    Delete "$INSTDIR\T1218.009.dll"
    RMDir /r "$INSTDIR\AutoIt"
    RMDir "$INSTDIR"
    DetailPrint "Cleanup complete."

    ; Attempt to stop and remove the service
    nsExec::ExecToLog 'sc.exe stop TestDriver'
    nsExec::ExecToLog 'sc.exe delete TestDriver'

SectionEnd