diff --git a/.DS_Store b/.DS_Store new file mode 100644 index 00000000..b44f269c Binary files /dev/null and b/.DS_Store differ diff --git a/atomics/T1050/T1050.yaml b/atomics/T1050/T1050.yaml index 38434dfd..36cd2050 100644 --- a/atomics/T1050/T1050.yaml +++ b/atomics/T1050/T1050.yaml @@ -20,8 +20,6 @@ atomic_tests: supported_platforms: - windows - input_arguments: - executor: name: powershell command: | diff --git a/atomics/T1070/T1070.yaml b/atomics/T1070/T1070.yaml index 1c5e738e..c9319649 100644 --- a/atomics/T1070/T1070.yaml +++ b/atomics/T1070/T1070.yaml @@ -6,7 +6,6 @@ atomic_tests: - name: Clear Logs description: | Clear Windows Event Logs - supported_platforms: - windows input_arguments: @@ -14,33 +13,25 @@ atomic_tests: description: Windows Log Name, ex System type: String default: System - executor: name: command_prompt command: | evtutil cl #{log_name} - - name: FSUtil description: | Manages the update sequence number (USN) change journal, which provides a persistent log of all changes made to files on the volume. - supported_platforms: - windows - input_arguments: - executor: name: command_prompt command: | fsutil usn deletejournal /D C: - - name: rm -rf description: | Delete system and audit logs - supported_platforms: - macos - linux - executor: name: sh command: | diff --git a/atomics/T1098/T1098.yaml b/atomics/T1098/T1098.yaml index 43baa340..05886865 100644 --- a/atomics/T1098/T1098.yaml +++ b/atomics/T1098/T1098.yaml @@ -6,12 +6,8 @@ atomic_tests: - name: Admin Account Manipulate description: | Manipulate Admin Account Name - supported_platforms: - windows - - input_arguments: - executor: name: powershell command: | diff --git a/atomics/T1173/T1173.yaml b/atomics/T1173/T1173.yaml index 6a38bc08..55b6d044 100644 --- a/atomics/T1173/T1173.yaml +++ b/atomics/T1173/T1173.yaml @@ -12,7 +12,6 @@ atomic_tests: executor: name: manual - command: | steps: | Open Microsoft Word diff --git a/atomics/T1197/T1197.yaml b/atomics/T1197/T1197.yaml index 8ef540f0..53753e6d 100644 --- a/atomics/T1197/T1197.yaml +++ b/atomics/T1197/T1197.yaml @@ -10,7 +10,6 @@ atomic_tests: supported_platforms: - windows - input_arguments: executor: name: command_prompt command: | @@ -21,7 +20,6 @@ atomic_tests: and execute a payload leveraging PowerShell supported_platforms: - windows - input_arguments: executor: name: powershell command: |