diff --git a/atomics/T1015/T1015.yaml b/atomics/T1015/T1015.yaml index 600cd1bd..ae2caa7e 100644 --- a/atomics/T1015/T1015.yaml +++ b/atomics/T1015/T1015.yaml @@ -47,5 +47,5 @@ atomic_tests: Foreach ($item in $input_table) { $item = $item.trim() - reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$item" /v Debugger /f - } \ No newline at end of file + reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$item" /v Debugger /f | Out-Null + } diff --git a/atomics/T1031/T1031.yaml b/atomics/T1031/T1031.yaml index dba8a12e..a08e21f6 100644 --- a/atomics/T1031/T1031.yaml +++ b/atomics/T1031/T1031.yaml @@ -20,4 +20,4 @@ atomic_tests: sc config Fax binPath= "C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe -noexit -c \"write-host 'T1031 Test'\"" sc start Fax cleanup_command: - sc config Fax binPath= "C:\WINDOWS\system32\fxssvc.exe" + sc config Fax binPath= "C:\WINDOWS\system32\fxssvc.exe" >nul 2>&1 diff --git a/atomics/T1037/T1037.yaml b/atomics/T1037/T1037.yaml index 5fa58ed7..9f4363eb 100644 --- a/atomics/T1037/T1037.yaml +++ b/atomics/T1037/T1037.yaml @@ -26,7 +26,7 @@ atomic_tests: echo "#{script_command}" > #{script_path} REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_SZ /d "#{script_path}" /f cleanup_command: | - REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f + REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f >nul 2>&1 del #{script_path} >nul 2>&1 del "%USERPROFILE%\desktop\T1037-log.txt" >nul 2>&1 @@ -43,8 +43,8 @@ atomic_tests: schtasks /create /tn "T1037_OnLogon" /sc onlogon /tr "cmd.exe /c calc.exe" schtasks /create /tn "T1037_OnStartup" /sc onstart /ru system /tr "cmd.exe /c calc.exe" cleanup_command: | - schtasks /delete /tn "T1037_OnLogon" /f - schtasks /delete /tn "T1037_OnStartup" /f + schtasks /delete /tn "T1037_OnLogon" /f >nul 2>&1 + schtasks /delete /tn "T1037_OnStartup" /f >nul 2>&1 - name: Logon Scripts - Mac description: | diff --git a/atomics/T1047/T1047.yaml b/atomics/T1047/T1047.yaml index b009a6a7..d3c5ba41 100644 --- a/atomics/T1047/T1047.yaml +++ b/atomics/T1047/T1047.yaml @@ -81,7 +81,7 @@ atomic_tests: command: | wmic process call create #{process_to_execute} cleanup_command: | - wmic process where name='#{process_to_execute}' delete + wmic process where name='#{process_to_execute}' delete >nul 2>&1 - name: WMI Execute Remote Process description: | @@ -106,5 +106,5 @@ atomic_tests: command: | wmic /node:"#{node}" process call create #{process_to_execute} cleanup_command: | - wmic /node:"#{node}" process where name='#{process_to_execute}' delete - + wmic /node:"#{node}" process where name='#{process_to_execute}' delete >nul 2>&1 + \ No newline at end of file