diff --git a/atomics/T1055.015/T1055.015.yaml b/atomics/T1055.015/T1055.015.yaml index 0a97fc6a..d8bed392 100644 --- a/atomics/T1055.015/T1055.015.yaml +++ b/atomics/T1055.015/T1055.015.yaml @@ -2,6 +2,7 @@ attack_technique: T1055.015 display_name: 'Process Injection: ListPlanting' atomic_tests: - name: Process injection ListPlanting + auto_generated_guid: 4f3c7502-b111-4dfe-8a6e-529307891a59 description: 'This test injects shellcode into a remote RegEdit process using the ListPlanting technique. ListPlanting exploits Window with ListView control. Code write to memory with NtWriteVirtualMemory. The shellcode is executed via PostMessage. When successful, a message box will appear with the title "Warning" and the content "Atomic Red Team" after a few seconds. Notepad will open following the appearance of the message box.' supported_platforms: - windows diff --git a/atomics/used_guids.txt b/atomics/used_guids.txt index 410d90a3..3f46cfbe 100644 --- a/atomics/used_guids.txt +++ b/atomics/used_guids.txt @@ -1501,3 +1501,4 @@ a9030b20-dd4b-4405-875e-3462c6078fdc 0128e48e-8c1a-433a-a11a-a5387384f1e1 1f6743da-6ecc-4a93-b03f-dc357e4b313f a72cfef8-d252-48b3-b292-635d332625c3 +4f3c7502-b111-4dfe-8a6e-529307891a59