security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update T1059.001.yaml

Browse Source 
Removing extra space in line 379
This commit is contained in:
Matt Graeber
2021-07-27 09:47:29 -04:00
committed by GitHub
parent ba20bcd95a
commit 0960fca14e
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1059.001/T1059.001.yaml
+1 -1
View File
@@ -376,7 +376,7 @@ atomic_tests:
command: 'Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -EncodedCommandParamVariation #{encoded_command_param_variation} -UseEncodedArguments -EncodedArgumentsParamVariation #{encoded_arguments_param_variation} -Execute -ErrorAction Stop'
name: powershell
- name: PowerShell Command Execution
- name: PowerShell Command Execution
auto_generated_guid: a538de64-1c74-46ed-aa60-b995ed302598
description: |
Use of obfuscated PowerShell to execute an arbitrary command; outputs "Hello, from PowerShell!". Example is from the 2021 Threat Detection Report by Red Canary.