T1546.008: re-add cleanup command lost during transition to subtechnique (#1087)

And improve it Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2020-06-26 17:26:01 +02:00
parent 53f879ea8e
commit dbf6e1af6e
1 changed files with 7 additions and 0 deletions
@@ -38,6 +38,13 @@ atomic_tests:
          New-ItemProperty -Path $registryPath -Name $name -Value $Value
        }
      }
+    cleanup_command: |
+      $input_table = "#{parent_list}".split(",")
+      Foreach ($item in $input_table)
+      {
+        $item = $item.trim()
+        reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$item" /v Debugger /f 2>&1 | Out-Null
+      }
    name: powershell
    elevation_required: true