diff --git a/atomics/T1055/T1055.yaml b/atomics/T1055/T1055.yaml index fa94cb2c..71b0dda5 100644 --- a/atomics/T1055/T1055.yaml +++ b/atomics/T1055/T1055.yaml @@ -130,6 +130,7 @@ atomic_tests: name: powershell elevation_required: false - name: Read-Write-Execute process Injection + auto_generated_guid: 0128e48e-8c1a-433a-a11a-a5387384f1e1 description: | This test exploited the vulnerability in legitimate PE formats where sections have RWX permission and enough space for shellcode. The RWX injection avoided the use of VirtualAlloc, WriteVirtualMemory, and ProtectVirtualMemory, thus evading detection mechanisms diff --git a/atomics/used_guids.txt b/atomics/used_guids.txt index ed295e0c..314f5e97 100644 --- a/atomics/used_guids.txt +++ b/atomics/used_guids.txt @@ -1498,3 +1498,4 @@ a9030b20-dd4b-4405-875e-3462c6078fdc 704333ca-cc12-4bcf-9916-101844881f54 505f24be-1c11-4694-b614-e01ae1cd2570 00cbb875-7ae4-4cf1-b638-e543fd825300 +0128e48e-8c1a-433a-a11a-a5387384f1e1