<commit_before>attack_technique: T1566.001
display_name: 'Phishing: Spearphishing Attachment'
atomic_tests:
- name: Download Phishing Attachment - VBScript
  auto_generated_guid: 114ccff9-ae6d-4547-9ead-4cd69f687306
  description: |
    The macro-enabled Excel file contains VBScript which opens your default web browser and opens it to [google.com](http://google.com).
    The below will successfully download the macro-enabled Excel file to the current location.
    File is downloaded to the %temp% folder.
  supported_platforms:
  - windows
  executor:
    command: |
      if (-not(Test-Path HKLM:SOFTWARE\Classes\Excel.Application)){
        return 'Please install Microsoft Excel before running this test.'
      }
      else{
        $url = 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1566.001/bin/PhishingAttachment.xlsm'
        $fileName = 'PhishingAttachment.xlsm'
        New-Item -Type File -Force -Path $fileName | out-null
        $wc = New-Object System.Net.WebClient
        $wc.Encoding = [System.Text.Encoding]::UTF8
        [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
        Invoke-WebRequest -Uri $url -OutFile $fileName
      }
    name: powershell
- name: Word spawned a command shell and used an IP address in the command line
  auto_generated_guid: cbb6799a-425c-4f83-9194-5447a909d67f
  description: |
    Word spawning a command prompt then running a command with an IP address in the command line is an indiciator of malicious activity.
    Upon execution, CMD will be lauchned and ping 8.8.8.8
  supported_platforms:
  - windows
  input_arguments:
    jse_path:
      description: |
        Path for the macro to write out the "malicious" .jse file
      type: String
      default: C:\Users\Public\art.jse
    ms_product:
      description: Maldoc application Word or Excel
      type: String
      default: Word
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Microsoft #{ms_product} must be installed
    prereq_command: |<commit_msg>description update and code to match (#1722)<commit_after>attack_technique: T1566.001
display_name: 'Phishing: Spearphishing Attachment'
atomic_tests:
- name: Download Macro-Enabled Phishing Attachment
  auto_generated_guid: 114ccff9-ae6d-4547-9ead-4cd69f687306
  description: |
    This atomic test downloads a macro enabled document from the Atomic Red Team GitHub repository, simulating an end user clicking a phishing link to download the file.
    The file "PhishingAttachment.xlsm" is downloaded to the %temp% directory.
  supported_platforms:
  - windows
  executor:
    command: |
      $url = 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1566.001/bin/PhishingAttachment.xlsm'
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      Invoke-WebRequest -Uri $url -OutFile $env:TEMP\PhishingAttachment.xlsm
    name: powershell
    cleanup_command: |
      Remove-Item $env:TEMP\PhishingAttachment.xlsm -ErrorAction Ignore

- name: Word spawned a command shell and used an IP address in the command line
  auto_generated_guid: cbb6799a-425c-4f83-9194-5447a909d67f
  description: |
    Word spawning a command prompt then running a command with an IP address in the command line is an indiciator of malicious activity.
    Upon execution, CMD will be lauchned and ping 8.8.8.8
  supported_platforms:
  - windows
  input_arguments:
    jse_path:
      description: |
        Path for the macro to write out the "malicious" .jse file
      type: String
      default: C:\Users\Public\art.jse
    ms_product:
      description: Maldoc application Word or Excel
      type: String
      default: Word
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Microsoft #{ms_product} must be installed
    prereq_command: |
{'fraction_non_alphanumeric': 0.07584778669427905, 'fraction_numerical': 0.033393735438778153, 'mean_word_length': 3.519298245614035, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 8, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '103872', 'n_tokens_mistral': 1230, 'n_tokens_neox': 1144, 'n_words': 353}