Update T1070.002.yaml
This commit is contained in:
@@ -152,74 +152,6 @@ atomic_tests:
|
||||
osascript -e 'tell application "Finder" to delete file "/var/log/system.log"'
|
||||
name: sh
|
||||
elevation_required: true
|
||||
- name: Delete system log files using JXA
|
||||
description: |
|
||||
Deletes the system log file using JXA
|
||||
supported_platforms:
|
||||
- macos
|
||||
input_arguments:
|
||||
input_file:
|
||||
description: source file
|
||||
type: path
|
||||
default: PathToAtomicsFolder/T1070.002/src/T1070-002-test.js
|
||||
dependency_executor_name: sh
|
||||
dependencies:
|
||||
- description: |
|
||||
the source file must exist on disk at specified location (#{input_file})
|
||||
prereq_command: |
|
||||
if [ -e #{input_file} ]; then exit 0; else exit 1; fi
|
||||
get_prereq_command: |
|
||||
wget https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1070.002/src/T1070-002-test.js -O #{input_file}
|
||||
executor:
|
||||
command: |
|
||||
chmod +x #{input_file}
|
||||
./#{input_file}
|
||||
name: bash
|
||||
- name: System log file deletion using Cocoa API - 1
|
||||
description: |
|
||||
Deletes the system log file using Cocoa API calls via OSAScript
|
||||
supported_platforms:
|
||||
- macos
|
||||
input_arguments:
|
||||
input_file:
|
||||
description: source file
|
||||
type: path
|
||||
default: PathToAtomicsFolder/T1070.002/src/T1070-002-test.scpt
|
||||
dependency_executor_name: sh
|
||||
dependencies:
|
||||
- description: |
|
||||
the source file must exist on disk at specified location (#{input_file})
|
||||
prereq_command: |
|
||||
if [ -e #{input_file} ]; then exit 0; else exit 1; fi
|
||||
get_prereq_command: |
|
||||
wget https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1070.002/src/T1070-002-test.scpt -O #{input_file}
|
||||
executor:
|
||||
command: |
|
||||
osascript #{input_file}
|
||||
name: bash
|
||||
- name: System log file deletion using Cocoa API - 2
|
||||
description: |
|
||||
Deletes the system log file using Cocoa API calls via Swift
|
||||
supported_platforms:
|
||||
- macos
|
||||
input_arguments:
|
||||
input_file:
|
||||
description: source file
|
||||
type: path
|
||||
default: PathToAtomicsFolder/T1070.002/src/T1070-002-test.swift
|
||||
dependency_executor_name: sh
|
||||
dependencies:
|
||||
- description: |
|
||||
the source file must exist on disk at specified location (#{input_file})
|
||||
prereq_command: |
|
||||
if [ -e #{input_file} ]; then exit 0; else exit 1; fi
|
||||
get_prereq_command: |
|
||||
wget https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1070.002/src/T1070-002-test.swift -O #{input_file}
|
||||
executor:
|
||||
command: |
|
||||
swiftc #{input_file}
|
||||
./#{input_file}
|
||||
name: bash
|
||||
- name: Overwrite Linux Mail Spool
|
||||
auto_generated_guid: 1602ff76-ed7f-4c94-b550-2f727b4782d4
|
||||
description: |
|
||||
|
||||
Reference in New Issue
Block a user