From 690097dc5d63c0062f67e2a55026838b960ce5ce Mon Sep 17 00:00:00 2001 From: Atomic Red Team doc generator Date: Thu, 12 Jan 2023 15:41:02 +0000 Subject: [PATCH] Generated docs from job=generate-docs branch=master [ci skip] --- atomics/Indexes/index.yaml | 6 +++--- atomics/T1053.005/T1053.005.md | 4 ++++ 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 8c03e8f8..c1809ef9 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -27827,7 +27827,7 @@ privilege-escalation: -UseBasicParsing) \nInvoke-MalDoc -macroFile \"PathToAtomicsFolder\\T1053.005\\src\\T1053.005-macrocode.txt\" -officeProduct \"#{ms_product}\" -sub \"Scheduler\"\n" name: powershell - cleanup command: 'Unregister-ScheduledTask -TaskName "Run Notepad" -Confirm:$false + cleanup_command: 'Unregister-ScheduledTask -TaskName "Run Notepad" -Confirm:$false ' - name: WMI Invoke-CimMethod Scheduled Task @@ -42643,7 +42643,7 @@ execution: -UseBasicParsing) \nInvoke-MalDoc -macroFile \"PathToAtomicsFolder\\T1053.005\\src\\T1053.005-macrocode.txt\" -officeProduct \"#{ms_product}\" -sub \"Scheduler\"\n" name: powershell - cleanup command: 'Unregister-ScheduledTask -TaskName "Run Notepad" -Confirm:$false + cleanup_command: 'Unregister-ScheduledTask -TaskName "Run Notepad" -Confirm:$false ' - name: WMI Invoke-CimMethod Scheduled Task @@ -49279,7 +49279,7 @@ persistence: -UseBasicParsing) \nInvoke-MalDoc -macroFile \"PathToAtomicsFolder\\T1053.005\\src\\T1053.005-macrocode.txt\" -officeProduct \"#{ms_product}\" -sub \"Scheduler\"\n" name: powershell - cleanup command: 'Unregister-ScheduledTask -TaskName "Run Notepad" -Confirm:$false + cleanup_command: 'Unregister-ScheduledTask -TaskName "Run Notepad" -Confirm:$false ' - name: WMI Invoke-CimMethod Scheduled Task diff --git a/atomics/T1053.005/T1053.005.md b/atomics/T1053.005/T1053.005.md index 4cc61bb2..0d018f49 100644 --- a/atomics/T1053.005/T1053.005.md +++ b/atomics/T1053.005/T1053.005.md @@ -212,6 +212,10 @@ IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/a Invoke-MalDoc -macroFile "PathToAtomicsFolder\T1053.005\src\T1053.005-macrocode.txt" -officeProduct "#{ms_product}" -sub "Scheduler" ``` +#### Cleanup Commands: +```powershell +Unregister-ScheduledTask -TaskName "Run Notepad" -Confirm:$false +```