diff --git a/atomics/T1003.007/T1003.007.yaml b/atomics/T1003.007/T1003.007.yaml index d6e49b4a..fbadc564 100644 --- a/atomics/T1003.007/T1003.007.yaml +++ b/atomics/T1003.007/T1003.007.yaml @@ -3,6 +3,7 @@ attack_technique: T1003.007 display_name: 'OS Credential Dumping: Proc Filesystem' atomic_tests: - name: Dump individual process memory with sh (Local) + auto_generated_guid: 7e91138a-8e74-456d-a007-973d67a0bb80 description: | Using `/proc/$PID/mem`, where $PID is the target process ID, use shell utilities to copy process memory to an external file so it can be searched or exfiltrated later. @@ -50,6 +51,7 @@ atomic_tests: rm -f "#{output_file}" - name: Dump individual process memory with Python (Local) + auto_generated_guid: 437b2003-a20d-4ed8-834c-4964f24eec63 description: | Using `/proc/$PID/mem`, where $PID is the target process ID, use a Python script to copy a process's heap memory to an external file so it can be searched or exfiltrated later. diff --git a/atomics/used_guids.txt b/atomics/used_guids.txt index e3e4f0c6..55f9ed27 100644 --- a/atomics/used_guids.txt +++ b/atomics/used_guids.txt @@ -714,3 +714,5 @@ c35ac4a8-19de-43af-b9f8-755da7e89c89 42f22b00-0242-4afc-a61b-0da05041f9cc c89becbe-1758-4e7d-a0f4-97d2188a23e3 8fd5a296-6772-4766-9991-ff4e92af7240 +7e91138a-8e74-456d-a007-973d67a0bb80 +437b2003-a20d-4ed8-834c-4964f24eec63