Skip to content

Commit 2f65db8

Browse files
mgraeber-rcmgraeber-rc
committed
Adding Invoke-ATHRemoteFXvGPUDisablementCommand
1 parent f734b9d commit 2f65db8

File tree

4 files changed

+391
-2
lines changed

4 files changed

+391
-2
lines changed

‎AtomicTestHarnesses.psd1

+7-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
RootModule = 'AtomicTestHarnesses.psm1'
55

66
# Version number of this module.
7-
ModuleVersion = '1.1.1.0'
7+
ModuleVersion = '1.2.0.0'
88

99
# ID used to uniquely identify this module
1010
GUID = '195a1637-d4a4-4cb3-8d80-5b5d4e3e930a'
@@ -27,6 +27,7 @@ PowerShellVersion = '5.0'
2727
# Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
2828
FunctionsToExport = 'Invoke-ATHHTMLApplication',
2929
'Invoke-ATHCompiledHelp',
30+
'Invoke-ATHRemoteFXvGPUDisablementCommand',
3031
'Out-ATHPowerShellCommandLineParameter',
3132
'Start-ATHProcessUnderSpecificParent'
3233

@@ -46,6 +47,11 @@ PrivateData = @{
4647

4748
# ReleaseNotes of this module
4849
ReleaseNotes = @'
50+
1.2.0
51+
-----
52+
Added:
53+
* Invoke-ATHRemoteFXvGPUDisablementCommand
54+
4955
1.1.1
5056
-----
5157
Added:

‎Readme.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,8 @@ Specific groups of tests can be run rather than running all available tests. The
9898
4. `T1059.001` - [Command and Scripting Interpreter: PowerShell](https://attack.mitre.org/techniques/T1059/001/)
9999
5. `T1134.004` - [Access Token Manipulation: Parent PID Spoofing](https://attack.mitre.org/techniques/T1134/004/)
100100
6. `T1218.001` - [Signed Binary Proxy Execution: Compiled HTML File](https://attack.mitre.org/techniques/T1218/001/)
101-
7. `T1218.005` - [Signed Binary Proxy Execution: Mshta](https://attack.mitre.org/techniques/T1218/005/)
101+
7. `T1218` - [Signed Binary Proxy Execution](https://attack.mitre.org/techniques/T1218/)
102+
8. `T1218.005` - [Signed Binary Proxy Execution: Mshta](https://attack.mitre.org/techniques/T1218/005/)
102103

103104
## Running Tests
104105

‎TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.Tests.ps1

+90
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
Set-StrictMode -Version Latest
2+
3+
$TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
4+
$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\"
5+
$ModuleManifest = "$ModuleRoot\AtomicTestHarnesses.psd1"
6+
7+
Remove-Module [A]tomicTestHarnesses
8+
Import-Module $ModuleManifest -Force -ErrorAction Stop
9+
10+
Describe 'Invoke-ATHRemoteFXvGPUDisablementCommand' {
11+
BeforeAll {
12+
$Help = Get-Help -Name Invoke-ATHRemoteFXvGPUDisablementCommand -Full
13+
14+
$ExpectedTechniqueID = $null
15+
16+
if ($Help.Synopsis.Split("`r`n")[-1] -match '^(?-i:Technique ID: )(?<TechniqueID>\S+) (?<TechniqueDescription>\(.+\))$') {
17+
$ExpectedTechniqueID = $Matches['TechniqueID']
18+
}
19+
20+
$FixedTestGuid = 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa'
21+
}
22+
23+
Context 'Validating error conditions' -Tag 'Unit', 'T1218' {
24+
It 'should not execute an EXE that is not RemoteFXvGPUDisablement.exe' -Tag 'Unit', 'T1218' {
25+
{ Invoke-ATHRemoteFXvGPUDisablementCommand -RemoteFXvGPUDisablementFilePath "$Env:windir\System32\notepad.exe" -ErrorAction Stop } | Should -Throw
26+
}
27+
}
28+
29+
Context 'Expected artifacts and behaviors when exercising the attack technique' -Tag 'Technique', 'T1218' {
30+
It 'should execute using default options' -Tag 'Technique', 'T1218' {
31+
$Result = Invoke-ATHRemoteFXvGPUDisablementCommand -TestGuid $FixedTestGuid
32+
33+
$Result | Should -Not -BeNullOrEmpty
34+
35+
$Result.TechniqueID | Should -BeExactly $ExpectedTechniqueID
36+
$Result.TestSuccess | Should -BeTrue
37+
$Result.TestGuid | Should -BeExactly $FixedTestGuid
38+
$Result.ModulePath | Should -Not -BeNullOrEmpty
39+
$Result.ModuleContents | Should -Not -BeNullOrEmpty
40+
$Result.ModuleFileHash | Should -Not -BeNullOrEmpty
41+
$Result.RunnerFilePath | Should -Match '\\System32\\RemoteFXvGPUDisablement.exe$'
42+
$Result.RunnerProcessId | Should -Not -BeNullOrEmpty
43+
$Result.RunnerCommandLine | Should -Match '\\System32\\RemoteFXvGPUDisablement.exe" Disable$'
44+
$Result.RunnerChildProcessId | Should -Not -BeNullOrEmpty
45+
$Result.RunnerChildProcessCommandLine | Should -MatchExactly "$($FixedTestGuid)`$"
46+
}
47+
48+
It 'should execute from a non-standard path' -Tag 'Technique', 'T1218' {
49+
$AlternatePath = "$env:windir\Temp\notepad.exe"
50+
51+
Copy-Item -Path "$Env:windir\System32\RemoteFXvGPUDisablement.exe" -Destination $AlternatePath -ErrorAction Stop
52+
53+
$Result = Invoke-ATHRemoteFXvGPUDisablementCommand -RemoteFXvGPUDisablementFilePath $AlternatePath -TestGuid $FixedTestGuid
54+
55+
$Result | Should -Not -BeNullOrEmpty
56+
57+
$Result.TechniqueID | Should -BeExactly $ExpectedTechniqueID
58+
$Result.TestSuccess | Should -BeTrue
59+
$Result.TestGuid | Should -BeExactly $FixedTestGuid
60+
$Result.ModulePath | Should -Not -BeNullOrEmpty
61+
$Result.ModuleContents | Should -Not -BeNullOrEmpty
62+
$Result.ModuleFileHash | Should -Not -BeNullOrEmpty
63+
$Result.RunnerFilePath | Should -BeExactly "$AlternatePath"
64+
$Result.RunnerProcessId | Should -Not -BeNullOrEmpty
65+
$Result.RunnerCommandLine | Should -BeExactly "`"$AlternatePath`" Disable"
66+
$Result.RunnerChildProcessId | Should -Not -BeNullOrEmpty
67+
$Result.RunnerChildProcessCommandLine | Should -MatchExactly "$($FixedTestGuid)`$"
68+
69+
Remove-Item -Path $AlternatePath -Force -ErrorAction SilentlyContinue
70+
}
71+
72+
It 'should execute using a module path that is not specified in %PSModulePath%' -Tag 'Technique', 'T1218' {
73+
$Result = Invoke-ATHRemoteFXvGPUDisablementCommand -ModulePath $Env:TEMP -TestGuid $FixedTestGuid
74+
75+
$Result | Should -Not -BeNullOrEmpty
76+
77+
$Result.TechniqueID | Should -BeExactly $ExpectedTechniqueID
78+
$Result.TestSuccess | Should -BeTrue
79+
$Result.TestGuid | Should -BeExactly $FixedTestGuid
80+
$Result.ModulePath.StartsWith("$Env:TEMP") | Should -BeTrue
81+
$Result.ModuleContents | Should -Not -BeNullOrEmpty
82+
$Result.ModuleFileHash | Should -Not -BeNullOrEmpty
83+
$Result.RunnerFilePath | Should -Match '\\System32\\RemoteFXvGPUDisablement.exe$'
84+
$Result.RunnerProcessId | Should -Not -BeNullOrEmpty
85+
$Result.RunnerCommandLine | Should -Match '\\System32\\RemoteFXvGPUDisablement.exe" Disable$'
86+
$Result.RunnerChildProcessId | Should -Not -BeNullOrEmpty
87+
$Result.RunnerChildProcessCommandLine | Should -MatchExactly "$($FixedTestGuid)`$"
88+
}
89+
}
90+
}

0 commit comments

Comments
 (0)