diff --git a/atomics/T1021.003/T1021.003.yaml b/atomics/T1021.003/T1021.003.yaml index f8551432..1499bf83 100644 --- a/atomics/T1021.003/T1021.003.yaml +++ b/atomics/T1021.003/T1021.003.yaml @@ -45,8 +45,6 @@ atomic_tests: } catch { exit 1 } get_prereq_command: | Write-Host "You will need to install Microsoft Excel manually to meet this requirement" - cleanup_command: | - Remove-Item 'C:\users\#{user}\AppData\local\Microsoft\WindowsApps\foxprow.exe' input_arguments: computer_name: description: Hostname or IP @@ -62,3 +60,5 @@ atomic_tests: $com = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application","#{computer_name}")) $com.ActivateMicrosoftApp("5") name: powershell + cleanup_command: | + Remove-Item 'C:\users\#{user}\AppData\local\Microsoft\WindowsApps\foxprow.exe' diff --git a/atomics/T1055.011/T1055.011.yaml b/atomics/T1055.011/T1055.011.yaml index 54bd7a89..2a2eccb0 100644 --- a/atomics/T1055.011/T1055.011.yaml +++ b/atomics/T1055.011/T1055.011.yaml @@ -8,12 +8,9 @@ atomic_tests: - windows input_arguments: arch: - description: Architecture of payload + description: Architecture of payload. One of (x64, x86) type: string default: x64 - choices: - - x64 - - x86 exe_binary: description: PE binary for EWM injection type: path diff --git a/atomics/T1056.001/T1056.001.yaml b/atomics/T1056.001/T1056.001.yaml index bf1b8b7d..df14bd54 100644 --- a/atomics/T1056.001/T1056.001.yaml +++ b/atomics/T1056.001/T1056.001.yaml @@ -132,7 +132,6 @@ atomic_tests: echo "" input_arguments: output_file: - name: output_file description: File to store captured commands type: string default: /tmp/.keyboard.log diff --git a/atomics/T1221/T1221.yaml b/atomics/T1221/T1221.yaml index 9cd29834..88191996 100644 --- a/atomics/T1221/T1221.yaml +++ b/atomics/T1221/T1221.yaml @@ -16,10 +16,6 @@ atomic_tests: type: path default: PathToAtomicsFolder\T1221\src\Calculator.docx dependency_executor_name: powershell - dependencies: - - description: | - prereq_command: | - get_prereq_command: | executor: command: | start "#{docx_file}"