security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Modified the Prereq_command of Test Unload Sysmon Filter Driver (#2807)

Browse Source 
* Modified the Prereq_command of Test Unload Sysmon Filter Driver

* modified typo on the description

---------

Co-authored-by: alphonsa-01 <NA>
This commit is contained in:
Alphonsa George
2024-06-13 17:07:09 -05:00
committed by GitHub
parent ebbf68eff2
commit 1cb761c5a0
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1562.001/T1562.001.yaml
+2 -2
View File
@@ -188,7 +188,7 @@ atomic_tests:
- name: Unload Sysmon Filter Driver
auto_generated_guid: 811b3e76-c41b-430c-ac0d-e2380bfaa164
description: |
Unloads the Sysinternals Sysmon filter driver without stopping the Sysmon service. To verify successful execution, o verify successful execution,
Unloads the Sysinternals Sysmon filter driver without stopping the Sysmon service. To verify successful execution,
run the prereq_command's and it should fail with an error of "sysmon filter must be loaded".
supported_platforms:
- windows
@@ -202,7 +202,7 @@ atomic_tests:
- description: |
Sysmon must be downloaded
prereq_command: |
if (-not (cmd.exe /c "where.exe Sysmon.exe 2> nul | findstr Sysmon 2> nul") -or (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe")) { exit 0 } else { exit 1 }
if ((cmd.exe /c "where.exe Sysmon.exe 2> nul | findstr /i Sysmon 2> nul") -or (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe")) { exit 0 } else { exit 1 }
get_prereq_command: |
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/Sysmon.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\Sysmon.zip"