diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 66dd2d6d..274ac5c3 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -61879,17 +61879,17 @@ persistence: \nit is possible to use Outlook Macro as a way to achieve persistance and execute arbitrary commands. This transform Outlook into a C2.\nToo achieve this two things must happened on the syste\n- The macro security registry - value must be set to '4'\n- A file called VbaProject.OTM must be created in + value must be set to '1'\n- A file called VbaProject.OTM must be created in the Outlook Folder.\n" supported_platforms: - windows executor: command: | - reg add "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security\Level" /t REG_DWORD /d 1 /f + reg add "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security" /v Level /t REG_DWORD /d 1 /f mkdir %APPDATA%\Microsoft\Outlook\ >nul 2>&1 echo "Atomic Red Team TEST" > %APPDATA%\Microsoft\Outlook\VbaProject.OTM cleanup_command: | - reg delete "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security\Level" /f >nul 2>&1 + reg delete "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security" /v Level /f >nul 2>&1 del %APPDATA%\Microsoft\Outlook\VbaProject.OTM >nul 2>&1 name: command_prompt T1098.003: diff --git a/atomics/Indexes/windows-index.yaml b/atomics/Indexes/windows-index.yaml index 0a0bab37..64e1f9a1 100644 --- a/atomics/Indexes/windows-index.yaml +++ b/atomics/Indexes/windows-index.yaml @@ -51110,17 +51110,17 @@ persistence: \nit is possible to use Outlook Macro as a way to achieve persistance and execute arbitrary commands. This transform Outlook into a C2.\nToo achieve this two things must happened on the syste\n- The macro security registry - value must be set to '4'\n- A file called VbaProject.OTM must be created in + value must be set to '1'\n- A file called VbaProject.OTM must be created in the Outlook Folder.\n" supported_platforms: - windows executor: command: | - reg add "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security\Level" /t REG_DWORD /d 1 /f + reg add "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security" /v Level /t REG_DWORD /d 1 /f mkdir %APPDATA%\Microsoft\Outlook\ >nul 2>&1 echo "Atomic Red Team TEST" > %APPDATA%\Microsoft\Outlook\VbaProject.OTM cleanup_command: | - reg delete "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security\Level" /f >nul 2>&1 + reg delete "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security" /v Level /f >nul 2>&1 del %APPDATA%\Microsoft\Outlook\VbaProject.OTM >nul 2>&1 name: command_prompt T1098.003: