From 19243f40d9aa80ce6c6e4fff6ca5decef47e47f8 Mon Sep 17 00:00:00 2001 From: CircleCI Atomic Red Team doc generator Date: Thu, 25 Jun 2020 17:09:11 +0000 Subject: [PATCH] Generate docs from job=validate_atomics_generate_docs branch=master --- atomics/Indexes/index.yaml | 2 +- atomics/T1033/T1033.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 4ad752ed..f9e291fe 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -37775,7 +37775,7 @@ discovery: wmic useraccount get /ALL quser /SERVER:"#{computer_name}" quser - qwinsta.exe" /server:#{computer_name} + qwinsta.exe /server:#{computer_name} qwinsta.exe for /F "tokens=1,2" %i in ('qwinsta /server:#{computer_name} ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt @FOR /F %n in (computers.txt) DO @FOR /F "tokens=1,2" %i in ('qwinsta /server:%n ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt diff --git a/atomics/T1033/T1033.md b/atomics/T1033/T1033.md index 2e6fd86d..a716c5a7 100644 --- a/atomics/T1033/T1033.md +++ b/atomics/T1033/T1033.md @@ -40,7 +40,7 @@ cmd.exe /C whoami wmic useraccount get /ALL quser /SERVER:"#{computer_name}" quser -qwinsta.exe" /server:#{computer_name} +qwinsta.exe /server:#{computer_name} qwinsta.exe for /F "tokens=1,2" %i in ('qwinsta /server:#{computer_name} ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt @FOR /F %n in (computers.txt) DO @FOR /F "tokens=1,2" %i in ('qwinsta /server:%n ^| findstr "Active Disc"') do @echo %i | find /v "#" | find /v "console" || echo %j > usernames.txt