Generated docs from job=generate-docs branch=master [ci skip]
This commit is contained in:
@@ -84444,14 +84444,14 @@ discovery:
|
||||
description: |
|
||||
Enumerates started system services using net.exe and writes them to a file. This technique has been used by multiple threat actors.
|
||||
|
||||
Upon successful execution, net.exe will run from cmd.exe that queries services. Expected output is to a txt file in c:\Windows\Temp\service-list.txt.s
|
||||
Upon successful execution, net.exe will run from cmd.exe that queries services. Expected output is to a txt file in in the temp directory called service-list.txt.
|
||||
supported_platforms:
|
||||
- windows
|
||||
input_arguments:
|
||||
output_file:
|
||||
description: Path of file to hold net.exe output
|
||||
type: Path
|
||||
default: C:\Windows\Temp\service-list.txt
|
||||
default: "%temp%\\service-list.txt"
|
||||
executor:
|
||||
command: 'net.exe start >> #{output_file}
|
||||
|
||||
|
||||
@@ -50,7 +50,7 @@ sc query state= all
|
||||
## Atomic Test #2 - System Service Discovery - net.exe
|
||||
Enumerates started system services using net.exe and writes them to a file. This technique has been used by multiple threat actors.
|
||||
|
||||
Upon successful execution, net.exe will run from cmd.exe that queries services. Expected output is to a txt file in c:\Windows\Temp\service-list.txt.s
|
||||
Upon successful execution, net.exe will run from cmd.exe that queries services. Expected output is to a txt file in in the temp directory called service-list.txt.
|
||||
|
||||
**Supported Platforms:** Windows
|
||||
|
||||
@@ -64,7 +64,7 @@ Upon successful execution, net.exe will run from cmd.exe that queries services.
|
||||
#### Inputs:
|
||||
| Name | Description | Type | Default Value |
|
||||
|------|-------------|------|---------------|
|
||||
| output_file | Path of file to hold net.exe output | Path | C:\Windows\Temp\service-list.txt|
|
||||
| output_file | Path of file to hold net.exe output | Path | %temp%\service-list.txt|
|
||||
|
||||
|
||||
#### Attack Commands: Run with `command_prompt`!
|
||||
|
||||
Reference in New Issue
Block a user