diff --git a/atomics/T1505.005/T1505.005.yaml b/atomics/T1505.005/T1505.005.yaml index a940bcfb..f3fb308f 100644 --- a/atomics/T1505.005/T1505.005.yaml +++ b/atomics/T1505.005/T1505.005.yaml @@ -27,6 +27,7 @@ atomic_tests: name: powershell - name: Modify Terminal Services DLL Path + auto_generated_guid: 18136e38-0530-49b2-b309-eed173787471 description: This atomic test simulates the modification of the ServiceDll value in HKLM\System\CurrentControlSet\services\TermService\Parameters. This technique may be leveraged by adversaries to establish persistence by loading a patched version of the DLL containing malicious code. supported_platforms: - windows diff --git a/atomics/used_guids.txt b/atomics/used_guids.txt index 9df41e27..d812d6c9 100644 --- a/atomics/used_guids.txt +++ b/atomics/used_guids.txt @@ -1408,3 +1408,4 @@ b7037b89-947a-427a-ba29-e7e9f09bc045 e12f5d8d-574a-4e9d-8a84-c0e8b4a8a675 7f66d539-4fbe-4cfa-9a56-4a2bf660c58a d380c318-0b34-45cb-9dad-828c11891e43 +18136e38-0530-49b2-b309-eed173787471