diff --git a/atomics/T1027/T1027.yaml b/atomics/T1027/T1027.yaml index 8b0c587a..4a4bb0a6 100644 --- a/atomics/T1027/T1027.yaml +++ b/atomics/T1027/T1027.yaml @@ -73,4 +73,4 @@ atomic_tests: Set-ItemProperty -Force -Path #{registry_key_storage} -Name #{registry_entry_storage} -Value $EncodedCommand powershell.exe -Command "IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp #{registry_key_storage} #{registry_entry_storage}).#{registry_entry_storage})))" cleanup_command: | - Remove-ItemProperty -Force -Path -Path #{registry_key_storage} -Name #{registry_entry_storage} + Remove-ItemProperty -Force -ErrorAction Ignore -Path #{registry_key_storage} -Name #{registry_entry_storage} \ No newline at end of file diff --git a/atomics/T1036/T1036.yaml b/atomics/T1036/T1036.yaml index 61459c94..b2693315 100644 --- a/atomics/T1036/T1036.yaml +++ b/atomics/T1036/T1036.yaml @@ -106,7 +106,7 @@ atomic_tests: $myT1036 = (Start-Process -PassThru -FilePath #{outputfile}).Id Stop-Process -ID $myT1036 cleanup_command: | - del #{outputfile} + Remove-Item #{outputfile} -Force -ErrorAction Ignore - name: Masquerading - windows exe running as different windows exe description: | @@ -133,7 +133,7 @@ atomic_tests: $myT1036 = (Start-Process -PassThru -FilePath #{outputfile}).Id Stop-Process -ID $myT1036 cleanup_command: | - del #{outputfile} + Remove-Item #{outputfile} -Force -ErrorAction Ignore - name: Malicious process Masquerading as LSM.exe description: | diff --git a/atomics/T1050/T1050.yaml b/atomics/T1050/T1050.yaml index 31241fa7..eeeb985e 100644 --- a/atomics/T1050/T1050.yaml +++ b/atomics/T1050/T1050.yaml @@ -48,8 +48,9 @@ atomic_tests: name: powershell elevation_required: true command: | - New-Service -Name "#{service_name}" -BinaryPathName "#{binary_path}" + New-Service -Name "#{service_name}" -BinaryPathName "#{binary_path}" 2>&1 | Out-Null Start-Service -Name "#{service_name}" cleanup_command: | - Stop-Service -Name "#{service_name}" - (Get-WmiObject Win32_Service -filter "name='#{service_name}'").Delete() + Stop-Service -Name "#{service_name}" 2>&1 | Out-Null + try {(Get-WmiObject Win32_Service -filter "name='#{service_name}'").Delete()} + catch {} \ No newline at end of file diff --git a/atomics/T1053/T1053.yaml b/atomics/T1053/T1053.yaml index 2a068f0b..d153d0f8 100644 --- a/atomics/T1053/T1053.yaml +++ b/atomics/T1053/T1053.yaml @@ -87,4 +87,4 @@ atomic_tests: $object = New-ScheduledTask -Action $Action -Principal $User -Trigger $Trigger -Settings $Set Register-ScheduledTask AtomicTask -InputObject $object cleanup_command: | - Unregister-ScheduledTask -TaskName "AtomicTask" -confirm:$false + Unregister-ScheduledTask -TaskName "AtomicTask" -confirm:$false >$null 2>&1