diff --git a/atomics/T1158/T1158.yaml b/atomics/T1158/T1158.yaml index a68023c2..d67cf4c5 100644 --- a/atomics/T1158/T1158.yaml +++ b/atomics/T1158/T1158.yaml @@ -147,4 +147,4 @@ atomic_tests: set-content -path . -stream #{ads_filename} -value "test3" ls -Recurse | %{ gi $_.Fullname -stream *} | where stream -ne ':$Data' | Select-Object pschildname cleanup_command: | - Remove-Item -Path #{file_name} + Remove-Item -Path #{file_name} -ErrorAction Ignore diff --git a/atomics/T1170/T1170.yaml b/atomics/T1170/T1170.yaml index 72b74fc7..6717e498 100644 --- a/atomics/T1170/T1170.yaml +++ b/atomics/T1170/T1170.yaml @@ -70,5 +70,4 @@ atomic_tests: $var.content|out-file "#{temp_file}" mshta "#{temp_file}" cleanup_command: | - remove-item "#{temp_file}" - + remove-item "#{temp_file}" -ErrorAction Ignore diff --git a/atomics/T1502/T1502.yaml b/atomics/T1502/T1502.yaml index 09d5e539..c5e39cec 100644 --- a/atomics/T1502/T1502.yaml +++ b/atomics/T1502/T1502.yaml @@ -41,5 +41,6 @@ atomic_tests: $ppid=Get-Process #{parent_process_name} | select -expand id PPID-Spoof -ppid $ppid -spawnto "#{spawnto_process_path}" -dllpath "#{dll_path}" cleanup_command: | - Stop-Process -Name "#{dll_process_name}" - Stop-Process -Name "#{spawnto_process_name}" \ No newline at end of file + Stop-Process -Name "#{dll_process_name}" -ErrorAction Ignore + Stop-Process -Name "#{spawnto_process_name}" -ErrorAction Ignore + \ No newline at end of file