removed windows test from t1036.005
This commit is contained in:
@@ -27,25 +27,3 @@ atomic_tests:
|
||||
cleanup_command: |
|
||||
rm -f $HOME/.../sh
|
||||
rmdir $HOME/.../
|
||||
|
||||
- name: Execute a process masquerading as a legitimate Windows binary
|
||||
description: |
|
||||
Create and execute a process masquerading as a legitimate Windows binary
|
||||
|
||||
supported_platforms:
|
||||
- windows
|
||||
|
||||
input_arguments:
|
||||
test_message:
|
||||
description: Test message to echo out to the screen
|
||||
type: String
|
||||
default: Hello from the Atomic Red Team test T1036.005#2
|
||||
|
||||
executor:
|
||||
name: command_prompt
|
||||
elevation_required: false
|
||||
command: |
|
||||
copy %WINDIR%\System32\cmd.exe /Y %PUBLIC%\svchost.exe
|
||||
start %PUBLIC%\svchost.exe /C echo "#{test_message}"
|
||||
cleanup_command: |
|
||||
del %PUBLIC%\svchost.exe >nul 2>&1
|
||||
|
||||
Reference in New Issue
Block a user