diff --git a/atomics/T1069.001/T1069.001.yaml b/atomics/T1069.001/T1069.001.yaml index 49c48a5c..d259deeb 100644 --- a/atomics/T1069.001/T1069.001.yaml +++ b/atomics/T1069.001/T1069.001.yaml @@ -13,6 +13,9 @@ atomic_tests: if [ -x "$(command -v dscacheutil)" ]; then dscacheutil -q group; else echo "dscacheutil is missing from the machine. skipping..."; fi; if [ -x "$(command -v dscl)" ]; then dscl . -list /Groups; else echo "dscl is missing from the machine. skipping..."; fi; if [ -x "$(command -v groups)" ]; then groups; else echo "groups is missing from the machine. skipping..."; fi; + if [ -x "$(command -v id)" ]; then id; else echo "id is missing from the machine. skipping..."; fi; + if [ -x "$(command -v getent)" ]; then getent group; else echo "getent is missing from the machine. skipping..."; fi; + cat /etc/group name: sh - name: Basic Permission Groups Discovery Windows (Local) auto_generated_guid: 1f454dd6-e134-44df-bebb-67de70fb6cd8 @@ -95,4 +98,4 @@ atomic_tests: executor: command: | Get-WMIObject Win32_Group - name: powershell \ No newline at end of file + name: powershell