diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index d3a43ae5..da3b2cc4 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -17163,7 +17163,7 @@ defense-evasion: description: "Administrative shares are hidden network shares created by Microsoft’s Windows NT operating systems that grant system administrators \nremote access to every disk volume on a network-connected system. These shares are automatically - created at started unless they have been\npurposefully disabled and is done + created at started unless they have been\npurposefully disabled as is done in this Atomic test. As Microsoft puts it, \"Missing administrative shares typically \nindicate that the computer in question has been compromised by malicious software.\"\nhttps://threatpost.com/conti-ransomware-gang-has-full-log4shell-attack-chain/177173/\n" diff --git a/atomics/T1070.005/T1070.005.md b/atomics/T1070.005/T1070.005.md index dbdde905..e239cf5f 100644 --- a/atomics/T1070.005/T1070.005.md +++ b/atomics/T1070.005/T1070.005.md @@ -121,7 +121,7 @@ Remove-FileShare -Name #{share_name} ## Atomic Test #4 - Disable Administrative Share Creation at Startup Administrative shares are hidden network shares created by Microsoft’s Windows NT operating systems that grant system administrators remote access to every disk volume on a network-connected system. These shares are automatically created at started unless they have been -purposefully disabled and is done in this Atomic test. As Microsoft puts it, "Missing administrative shares typically +purposefully disabled as is done in this Atomic test. As Microsoft puts it, "Missing administrative shares typically indicate that the computer in question has been compromised by malicious software." https://threatpost.com/conti-ransomware-gang-has-full-log4shell-attack-chain/177173/