From 4d272cdcdc167b85bd57bd1ac383d0e78ed201f6 Mon Sep 17 00:00:00 2001 From: Carrie Roberts Date: Thu, 16 Mar 2023 09:44:03 -0600 Subject: [PATCH] remove unused inputargs (#2366) --- atomics/T1087.002/T1087.002.yaml | 9 --------- 1 file changed, 9 deletions(-) diff --git a/atomics/T1087.002/T1087.002.yaml b/atomics/T1087.002/T1087.002.yaml index fb1f6e15..d77a3228 100644 --- a/atomics/T1087.002/T1087.002.yaml +++ b/atomics/T1087.002/T1087.002.yaml @@ -320,15 +320,6 @@ atomic_tests: This is done remotely via wmic and captures the event code 4776 from the domain controller and stores the ouput in C:\temp. [Reference](https://www.reliaquest.com/blog/socgholish-fakeupdates/) supported_platforms: - windows - input_arguments: - Domain: - description: Domain that is being tested against - type: string - default: $env:USERDOMAIN - DomainController: - description: Domain Controller that is being tested against - type: string - default: $env:UserDnsDomain executor: command: |- wmic /node:$env:UserDnsDomain process call create 'wevtutil epl Security C:\Temp\ntlmusers.evtx /q:Event[System[(EventID=4776)]]'