security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update T1546.yaml (#2865)

Browse Source 
New Test : Adding custom debugger for Windows Error Reporting

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
This commit is contained in:
abhijose09
2024-07-24 07:50:48 +05:30
committed by GitHub
parent 2d3c1652a4
commit bd13bcbaec
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1546/T1546.yaml
+13 -1
View File
@@ -121,4 +121,16 @@ atomic_tests:
# Clean up the CIM session
Remove-CimSession -CimSession $CimSession
- name: Adding custom debugger for Windows Error Reporting
description: |
When applications hang, the Windows Error Reporting framework allows us to attach a debugger, if it is set up in the Registry.
Adding executable of choice will let the executable to auto-execute when during any application crash due to functioning of WER framework
supported_platforms:
- windows
executor:
command: |
reg add "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Hangs" /v Debugger /t REG_SZ /d "C:\Windows\System32\notepad.exe" /f
cleanup_command: |
reg delete "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Hangs" /v Debugger /f
name: command_prompt
elevation_required: true