diff --git a/atomics/T1546/T1546.yaml b/atomics/T1546/T1546.yaml index e9ab23c3..84f9688c 100644 --- a/atomics/T1546/T1546.yaml +++ b/atomics/T1546/T1546.yaml @@ -121,4 +121,16 @@ atomic_tests: # Clean up the CIM session Remove-CimSession -CimSession $CimSession - +- name: Adding custom debugger for Windows Error Reporting + description: | + When applications hang, the Windows Error Reporting framework allows us to attach a debugger, if it is set up in the Registry. + Adding executable of choice will let the executable to auto-execute when during any application crash due to functioning of WER framework + supported_platforms: + - windows + executor: + command: | + reg add "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Hangs" /v Debugger /t REG_SZ /d "C:\Windows\System32\notepad.exe" /f + cleanup_command: | + reg delete "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Hangs" /v Debugger /f + name: command_prompt + elevation_required: true