From 0d262d6dfb9b682bb11992c685cb4fa87efbb8a3 Mon Sep 17 00:00:00 2001 From: frack113 <62423083+frack113@users.noreply.github.com> Date: Wed, 31 Aug 2022 01:19:43 +0200 Subject: [PATCH] Fix windows Logoff (#2105) --- atomics/T1529/T1529.yaml | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/atomics/T1529/T1529.yaml b/atomics/T1529/T1529.yaml index de248b1b..34927fa8 100644 --- a/atomics/T1529/T1529.yaml +++ b/atomics/T1529/T1529.yaml @@ -129,13 +129,8 @@ atomic_tests: This test performs a Windows system logoff as seen in [dcrat backdoor capabilities](https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor) supported_platforms: - windows - input_arguments: - timeout: - description: Timeout period before shutdown (seconds) - type: Integer - default: 1 executor: command: | - shutdown /l /t #{timeout} + shutdown /l name: command_prompt elevation_required: true