diff --git a/atomics/T1070/T1070.md b/atomics/T1070/T1070.md index 954d1e05..e9eb7cc0 100644 --- a/atomics/T1070/T1070.md +++ b/atomics/T1070/T1070.md @@ -12,7 +12,7 @@ Defense Bypassed: Anti-virus, Log analysis, Host intrusion prevention systems -## Atomic Test #1 - Clear Logs +## Atomic Test #1 - Clear Logs Clear Windows Event Logs **Supported Platforms:** Windows @@ -34,7 +34,7 @@ Clear Windows Event Logs #### Run it with `command_prompt`! ``` -evtutil cl #{log_name} +wevtutil cl #{log_name} ```

diff --git a/atomics/index.md b/atomics/index.md index 2461586f..be80c1b6 100644 --- a/atomics/index.md +++ b/atomics/index.md @@ -187,7 +187,7 @@ - [T1054 Indicator Blocking](https://github.com/redcanaryco/atomic-red-team/blob/uppercase-everything/CONTRIBUTIONS.md) - [T1066 Indicator Removal from Tools](https://github.com/redcanaryco/atomic-red-team/blob/uppercase-everything/CONTRIBUTIONS.md) - [T1070 Indicator Removal on Host](./T1070/T1070.md) - - Atomic Test #1: Clear Logs [windows] + - Atomic Test #1: Clear Logs [windows] - Atomic Test #2: FSUtil [windows] - Atomic Test #3: rm -rf [macos, linux] - [T1202 Indirect Command Execution](./T1202/T1202.md) diff --git a/atomics/windows-index.md b/atomics/windows-index.md index 026a68f6..c4a2187c 100644 --- a/atomics/windows-index.md +++ b/atomics/windows-index.md @@ -41,7 +41,7 @@ - [T1054 Indicator Blocking](https://github.com/redcanaryco/atomic-red-team/blob/uppercase-everything/CONTRIBUTIONS.md) - [T1066 Indicator Removal from Tools](https://github.com/redcanaryco/atomic-red-team/blob/uppercase-everything/CONTRIBUTIONS.md) - [T1070 Indicator Removal on Host](./T1070/T1070.md) - - Atomic Test #1: Clear Logs [windows] + - Atomic Test #1: Clear Logs [windows] - Atomic Test #2: FSUtil [windows] - [T1202 Indirect Command Execution](./T1202/T1202.md) - Atomic Test #1: Indirect Command Execution - pcalua.exe [windows]