diff --git a/atomics/T1547.004/T1547.004.yaml b/atomics/T1547.004/T1547.004.yaml index 6df8864c..79757b40 100644 --- a/atomics/T1547.004/T1547.004.yaml +++ b/atomics/T1547.004/T1547.004.yaml @@ -64,6 +64,7 @@ atomic_tests: name: powershell - name: Winlogon HKLM Shell Key Persistence - PowerShell + auto_generated_guid: 95a3c42f-8c88-4952-ad60-13b81d929a9d description: | PowerShell code to set Winlogon shell key to execute a binary at logon along with explorer.exe. @@ -83,6 +84,7 @@ atomic_tests: name: powershell - name: Winlogon HKLM Userinit Key Persistence - PowerShell + auto_generated_guid: f9b8daff-8fa7-4e6a-a1a7-7c14675a545b description: | PowerShell code to set Winlogon userinit key to execute a binary at logon along with userinit.exe. diff --git a/atomics/used_guids.txt b/atomics/used_guids.txt index fbf43022..c8111536 100644 --- a/atomics/used_guids.txt +++ b/atomics/used_guids.txt @@ -1164,3 +1164,5 @@ c7a0bb71-70ce-4a53-b115-881f241b795b ffcbfaab-c9ff-470b-928c-f086b326089b 333c7de0-6fbe-42aa-ac2b-c7e40b18246a 34557863-344a-468f-808b-a1bfb89b4fa9 +95a3c42f-8c88-4952-ad60-13b81d929a9d +f9b8daff-8fa7-4e6a-a1a7-7c14675a545b