Adding Get-ATHDriverService, New-ATHDriverService, Remove-ATHDriverSe…

…rvice

AtomicTestHarnesses.psd1

@@ -4,7 +4,7 @@
 RootModule = 'AtomicTestHarnesses.psm1'
 
 # Version number of this module.
-ModuleVersion = '1.6.0.0'
+ModuleVersion = '1.7.0.0'
 
 # ID used to uniquely identify this module
 GUID = '195a1637-d4a4-4cb3-8d80-5b5d4e3e930a'
@@ -25,13 +25,16 @@ Description = 'A module to facilitate the testing of attack techniques and their
 PowerShellVersion = '5.0'
 
 # Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
-FunctionsToExport = 'Invoke-ATHHTMLApplication',
+FunctionsToExport = 'Get-ATHDriverService',
+                    'Invoke-ATHHTMLApplication',
                     'Invoke-ATHCompiledHelp',
                     'Invoke-ATHCorProfiler',
                     'Invoke-ATHInjectedThread',
                     'Invoke-ATHMSBuild',
                     'Invoke-ATHRemoteFXvGPUDisablementCommand',
+                    'New-ATHDriverService',
                     'Out-ATHPowerShellCommandLineParameter',
+                    'Remove-ATHDriverService',
                     'Start-ATHProcessHerpaderp',
                     'Start-ATHProcessUnderSpecificParent'
 
@@ -52,6 +55,13 @@ PrivateData = @{
 
         # ReleaseNotes of this module
         ReleaseNotes = @'
+1.7.0
+-----
+Added:
+* New-ATHDriverService
+* Get-ATHDriverService
+* Remove-ATHDriverService
+
 1.6.0
 -----
 Added:

TestHarnesses/T1543.003_WindowsService/DriverInstaller.Tests.ps1

@@ -0,0 +1,97 @@
+Set-StrictMode -Version Latest
+
+$TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent
+$ModuleRoot = Resolve-Path "$TestScriptRoot\..\..\"
+$ModuleManifest = "$ModuleRoot\AtomicTestHarnesses.psd1"
+
+Remove-Module [A]tomicTestHarnesses
+Import-Module $ModuleManifest -Force -ErrorAction Stop
+
+Describe 'Get-ATHDriverService' {
+    BeforeAll {
+        $Help = Get-Help -Name Get-ATHDriverService -Full
+
+        $ExpectedTechniqueID = $null
+
+        if ($Help.Synopsis.Split("`r`n")[-1] -match '^(?-i:Technique ID: )(?<TechniqueID>\S+) (?<TechniqueDescription>\(.+\))$') {
+            $ExpectedTechniqueID = $Matches['TechniqueID']
+        }
+    }
+
+    Context 'Validating error conditions' -Tag 'Unit', 'T1543.003' {
+        It 'should return detailed, contextual information for a running driver service based on the service name' {
+            $ServiceName = 'cdrom'
+
+            $Result = Get-ATHDriverService -ServiceName $ServiceName -ErrorAction Stop
+
+            $Result | Should -Not -BeNullOrEmpty
+
+            $Result.TechniqueID                   | Should -BeExactly $ExpectedTechniqueID
+            $Result.ServiceName                   | Should -Be $ServiceName
+            $Result.ServiceDisplayName            | Should -Not -BeNullOrEmpty
+            $Result.ServiceStartMode              | Should -Not -BeNullOrEmpty
+            $Result.ServiceState                  | Should -Not -BeNullOrEmpty
+            $Result.ServiceType                   | Should -BeExactly 'Kernel Driver'
+            $Result.ServiceRegistryKey            | Should -Be "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\$ServiceName"
+            $Result.DriverPathFormatted           | Should -Match '^[A-Z]:\\'
+            $Result.DriverPathFormatted.EndsWith('cdrom.sys')   | Should -BeTrue
+            $Result.DriverPathUnformatted.EndsWith('cdrom.sys') | Should -BeTrue
+            $Result.DriverFileHashSHA256          | Should -Not -BeNullOrEmpty
+            $Result.LoadedImageBaseAddress        | Should -Not -BeNullOrEmpty
+            $Result.LoadedImageSize               | Should -Not -BeNullOrEmpty
+            $Result.LoadCount                     | Should -BeGreaterThan 0
+        }
+
+        It 'should throw an error when a non-existent service name is supplied' {
+            { Get-ATHDriverService -ServiceName ' ' -ErrorAction Stop } | Should -Throw
+        }
+
+        It 'should return detailed, contextual information for a running driver service when a driver filename is supplied' {
+            $DriverFilename = 'cdrom.sys'
+
+            $Result = Get-ATHDriverService -LoadedDriverFileName $DriverFilename -ErrorAction Stop
+
+            $Result | Should -Not -BeNullOrEmpty
+
+            $Result.TechniqueID                   | Should -BeExactly $ExpectedTechniqueID
+            $Result.ServiceName                   | Should -Not -BeNullOrEmpty
+            $Result.ServiceDisplayName            | Should -Not -BeNullOrEmpty
+            $Result.ServiceStartMode              | Should -Not -BeNullOrEmpty
+            $Result.ServiceState                  | Should -Not -BeNullOrEmpty
+            $Result.ServiceType                   | Should -BeExactly 'Kernel Driver'
+            $Result.ServiceRegistryKey            | Should -Not -BeNullOrEmpty
+            $Result.DriverPathFormatted           | Should -Match '^[A-Z]:\\'
+            $Result.DriverPathFormatted.EndsWith($DriverFilename)   | Should -BeTrue
+            $Result.DriverPathUnformatted.EndsWith($DriverFilename) | Should -BeTrue
+            $Result.DriverFileHashSHA256          | Should -Not -BeNullOrEmpty
+            $Result.LoadedImageBaseAddress        | Should -Not -BeNullOrEmpty
+            $Result.LoadedImageSize               | Should -Not -BeNullOrEmpty
+            $Result.LoadCount                     | Should -BeGreaterThan 0
+        }
+
+        It 'should not return output when a non-existent driver path is supplied' {
+            $Result = Get-ATHDriverService -LoadedDriverFileName ' ' -ErrorAction Stop | Should -BeNullOrEmpty
+
+            $Result | Should -BeNullOrEmpty
+        }
+    }
+}
+
+
+Describe 'Remove-ATHDriverService' {
+    BeforeAll {
+        $Help = Get-Help -Name Get-ATHDriverService -Full
+
+        $ExpectedTechniqueID = $null
+
+        if ($Help.Synopsis.Split("`r`n")[-1] -match '^(?-i:Technique ID: )(?<TechniqueID>\S+) (?<TechniqueDescription>\(.+\))$') {
+            $ExpectedTechniqueID = $Matches['TechniqueID']
+        }
+    }
+
+    Context 'Validating error conditions' -Tag 'Unit', 'T1543.003' {
+        It 'should throw an error when a non-existent service name is supplied' {
+            { Remove-ATHDriverService -ServiceName ' ' -ErrorAction Stop } | Should -Throw
+        }
+    }
+}