security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update T1012.yaml (#2959)

Browse Source 
* Update T1012.yaml

New atomic added.

* Update T1012.yaml

Command structre fixed

* Update T1012.yaml

Accidentally put a space at the beginning of the file.

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
This commit is contained in:
Burak Karaduman
2024-10-25 03:14:38 +03:00
committed by GitHub
parent 93a62234c5
commit d93cb3713b
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1012/T1012.yaml
+9
View File
@@ -126,3 +126,12 @@ atomic_tests:
reg.exe query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64
name: command_prompt
elevation_required: true
- name: Inspect SystemStartOptions Value in Registry
description: The objective of this test is to query the SystemStartOptions key under HKLM\SYSTEM\CurrentControlSet\Control in the Windows registry. This action could be used to uncover specific details about how the system is configured to start, potentially aiding in understanding boot parameters or identifying security-related settings.
key is.
supported_platforms:
- windows
executor:
name: command_prompt
command: |
reg.exe query HKLM\SYSTEM\CurrentControlSet\Control /v SystemStartOptions