diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 3adf9eda..4f451fdb 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -13588,7 +13588,7 @@ privilege-escalation: command: | sudo cp #{path_malicious_plist} /Library/LaunchDaemons/#{plist_filename} sudo launchctl load -w /Library/LaunchDaemons/#{plist_filename} - cleanup: | + cleanup_command: | sudo launchctl unload /Library/LaunchDaemons/#{plist_filename} sudo rm /Library/LaunchDaemons/#{plist_filename} T1053.004: @@ -41610,7 +41610,7 @@ persistence: command: | sudo cp #{path_malicious_plist} /Library/LaunchDaemons/#{plist_filename} sudo launchctl load -w /Library/LaunchDaemons/#{plist_filename} - cleanup: | + cleanup_command: | sudo launchctl unload /Library/LaunchDaemons/#{plist_filename} sudo rm /Library/LaunchDaemons/#{plist_filename} T1053.004: diff --git a/atomics/T1543.004/T1543.004.md b/atomics/T1543.004/T1543.004.md index d3aaeda3..b9992d60 100644 --- a/atomics/T1543.004/T1543.004.md +++ b/atomics/T1543.004/T1543.004.md @@ -40,6 +40,11 @@ sudo cp #{path_malicious_plist} /Library/LaunchDaemons/#{plist_filename} sudo launchctl load -w /Library/LaunchDaemons/#{plist_filename} ``` +#### Cleanup Commands: +```bash +sudo launchctl unload /Library/LaunchDaemons/#{plist_filename} +sudo rm /Library/LaunchDaemons/#{plist_filename} +```