From 2f1c0e9f768ea7ff13c571dc9de5d2985c82b8e6 Mon Sep 17 00:00:00 2001 From: D4rkCiph3r <102921060+D4rkCiph3r@users.noreply.github.com> Date: Sat, 18 Feb 2023 13:18:46 +0530 Subject: [PATCH] Update T1070.002.yaml --- atomics/T1070.002/T1070.002.yaml | 68 -------------------------------- 1 file changed, 68 deletions(-) diff --git a/atomics/T1070.002/T1070.002.yaml b/atomics/T1070.002/T1070.002.yaml index d16eefa6..403e6da8 100644 --- a/atomics/T1070.002/T1070.002.yaml +++ b/atomics/T1070.002/T1070.002.yaml @@ -152,74 +152,6 @@ atomic_tests: osascript -e 'tell application "Finder" to delete file "/var/log/system.log"' name: sh elevation_required: true -- name: Delete system log files using JXA - description: | - Deletes the system log file using JXA - supported_platforms: - - macos - input_arguments: - input_file: - description: source file - type: path - default: PathToAtomicsFolder/T1070.002/src/T1070-002-test.js - dependency_executor_name: sh - dependencies: - - description: | - the source file must exist on disk at specified location (#{input_file}) - prereq_command: | - if [ -e #{input_file} ]; then exit 0; else exit 1; fi - get_prereq_command: | - wget https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1070.002/src/T1070-002-test.js -O #{input_file} - executor: - command: | - chmod +x #{input_file} - ./#{input_file} - name: bash -- name: System log file deletion using Cocoa API - 1 - description: | - Deletes the system log file using Cocoa API calls via OSAScript - supported_platforms: - - macos - input_arguments: - input_file: - description: source file - type: path - default: PathToAtomicsFolder/T1070.002/src/T1070-002-test.scpt - dependency_executor_name: sh - dependencies: - - description: | - the source file must exist on disk at specified location (#{input_file}) - prereq_command: | - if [ -e #{input_file} ]; then exit 0; else exit 1; fi - get_prereq_command: | - wget https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1070.002/src/T1070-002-test.scpt -O #{input_file} - executor: - command: | - osascript #{input_file} - name: bash -- name: System log file deletion using Cocoa API - 2 - description: | - Deletes the system log file using Cocoa API calls via Swift - supported_platforms: - - macos - input_arguments: - input_file: - description: source file - type: path - default: PathToAtomicsFolder/T1070.002/src/T1070-002-test.swift - dependency_executor_name: sh - dependencies: - - description: | - the source file must exist on disk at specified location (#{input_file}) - prereq_command: | - if [ -e #{input_file} ]; then exit 0; else exit 1; fi - get_prereq_command: | - wget https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1070.002/src/T1070-002-test.swift -O #{input_file} - executor: - command: | - swiftc #{input_file} - ./#{input_file} - name: bash - name: Overwrite Linux Mail Spool auto_generated_guid: 1602ff76-ed7f-4c94-b550-2f727b4782d4 description: |