diff --git a/atomics/T1087.002/T1087.002.yaml b/atomics/T1087.002/T1087.002.yaml index fb1f6e15..d77a3228 100644 --- a/atomics/T1087.002/T1087.002.yaml +++ b/atomics/T1087.002/T1087.002.yaml @@ -320,15 +320,6 @@ atomic_tests: This is done remotely via wmic and captures the event code 4776 from the domain controller and stores the ouput in C:\temp. [Reference](https://www.reliaquest.com/blog/socgholish-fakeupdates/) supported_platforms: - windows - input_arguments: - Domain: - description: Domain that is being tested against - type: string - default: $env:USERDOMAIN - DomainController: - description: Domain Controller that is being tested against - type: string - default: $env:UserDnsDomain executor: command: |- wmic /node:$env:UserDnsDomain process call create 'wevtutil epl Security C:\Temp\ntlmusers.evtx /q:Event[System[(EventID=4776)]]'