Update T1053.005.yaml (#2276)

* Update T1053.005.yaml Created cleanup command for T1053.005-Task Scheduler via VBA-Cleanup commands created * Update T1053.005.yaml Fixed syntax error. Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2023-01-10 17:41:32 -06:00
parent c4c81934d2
commit c093205999
1 changed files with 2 additions and 0 deletions
@@ -127,6 +127,8 @@ atomic_tests:
      IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) 
      Invoke-MalDoc -macroFile "PathToAtomicsFolder\T1053.005\src\T1053.005-macrocode.txt" -officeProduct "#{ms_product}" -sub "Scheduler"
    name: powershell
+    cleanup command : |
+      Unregister-ScheduledTask -TaskName "Run Notepad" -Confirm:$false
 - name: WMI Invoke-CimMethod Scheduled Task
  auto_generated_guid: e16b3b75-dc9e-4cde-a23d-dfa2d0507b3b
  description: |