diff --git a/atomics/T1529/T1529.yaml b/atomics/T1529/T1529.yaml index de248b1b..34927fa8 100644 --- a/atomics/T1529/T1529.yaml +++ b/atomics/T1529/T1529.yaml @@ -129,13 +129,8 @@ atomic_tests: This test performs a Windows system logoff as seen in [dcrat backdoor capabilities](https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor) supported_platforms: - windows - input_arguments: - timeout: - description: Timeout period before shutdown (seconds) - type: Integer - default: 1 executor: command: | - shutdown /l /t #{timeout} + shutdown /l name: command_prompt elevation_required: true