diff --git a/atomics/T1021.003/T1021.003.yaml b/atomics/T1021.003/T1021.003.yaml index 46e5b655..7c9a27da 100644 --- a/atomics/T1021.003/T1021.003.yaml +++ b/atomics/T1021.003/T1021.003.yaml @@ -2,6 +2,7 @@ attack_technique: T1021.003 display_name: 'Remote Services: Distributed Component Object Model' atomic_tests: - name: PowerShell Lateral Movement using MMC20 + auto_generated_guid: 6dc74eb1-c9d6-4c53-b3b5-6f50ae339673 description: | Powershell lateral movement using the mmc20 application com object. @@ -22,7 +23,6 @@ atomic_tests: [activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.application","#{computer_name}")).Document.ActiveView.ExecuteShellCommand("c:\windows\system32\calc.exe", $null, $null, "7") name: powershell - name: PowerShell Lateral Movement Using Excel Application Object - auto_generated_guid: b46d327c-c336-43d9-906e-d53be5358535 description: | Powershell lateral movement using the Excel COM objects.