diff --git a/atomics/T1001.002/T1001.002.yaml b/atomics/T1001.002/T1001.002.yaml index 4adac144..cd2052ca 100644 --- a/atomics/T1001.002/T1001.002.yaml +++ b/atomics/T1001.002/T1001.002.yaml @@ -148,6 +148,7 @@ atomic_tests: Remove-Item -Path "$HOME\decoded.ps1" -Force -ErrorAction Ignore - name: Execute Embedded Script in Image via Steganography + auto_generated_guid: 4ff61684-ad91-405c-9fbc-048354ff1d07 description: This atomic test demonstrates the execution of an embedded script in an image file using steganography techniques. The script is first encoded in base64 and then embedded within the pixels of the image. The modified image is created, and the script is extracted and executed on the target system. supported_platforms: - linux diff --git a/atomics/T1490/T1490.yaml b/atomics/T1490/T1490.yaml index 0027a76e..5bedb437 100644 --- a/atomics/T1490/T1490.yaml +++ b/atomics/T1490/T1490.yaml @@ -174,6 +174,7 @@ atomic_tests: cleanup_command: | sc sdset VSS D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;LC;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD) - name: Disable Time Machine + auto_generated_guid: ed952f70-91d4-445a-b7ff-30966bfb1aff description: | Disables Time Machine which is Apple's automated backup utility software. Attackers can use this to prevent backups from occurring and hinder the victim's ability to recover from any damage. supported_platforms: diff --git a/atomics/used_guids.txt b/atomics/used_guids.txt index 4c55063b..f99b6b26 100644 --- a/atomics/used_guids.txt +++ b/atomics/used_guids.txt @@ -1589,3 +1589,5 @@ fc631702-3f03-4f2b-8d8a-6b3d055580a1 94be7646-25f6-467e-af23-585fb13000c8 2169e8b0-2ee7-44cb-8a6e-d816a5db7d8a f3ad3c5b-1db1-45c1-81bf-d3370ebab6c8 +4ff61684-ad91-405c-9fbc-048354ff1d07 +ed952f70-91d4-445a-b7ff-30966bfb1aff