Generate docs from job=validate_atomics_generate_docs branch=master

atomics/Indexes/Indexes-CSV/index.csv

@@ -231,7 +231,7 @@ defense-evasion,T1070.002,Clear Linux or Mac System Logs,1,rm -rf,989cc1b1-3642-
 defense-evasion,T1070.002,Clear Linux or Mac System Logs,2,Overwrite Linux Mail Spool,1602ff76-ed7f-4c94-b550-2f727b4782d4,bash
 defense-evasion,T1070.002,Clear Linux or Mac System Logs,3,Overwrite Linux Log,d304b2dc-90b4-4465-a650-16ddd503f7b5,bash
 defense-evasion,T1070.001,Clear Windows Event Logs,1,Clear Logs,e6abb60e-26b8-41da-8aae-0c35174b0967,command_prompt
-defense-evasion,T1070.001,Clear Windows Event Logs,2,Delete System Logs Using Clear-EventLogId,b13e9306-3351-4b4b-a6e8-477358b0b498,powershell
+defense-evasion,T1070.001,Clear Windows Event Logs,2,Delete System Logs Using Clear-EventLog,b13e9306-3351-4b4b-a6e8-477358b0b498,powershell
 defense-evasion,T1027.004,Compile After Delivery,1,Compile After Delivery using csc.exe,ffcdbd6a-b0e8-487d-927a-09127fe9a206,command_prompt
 defense-evasion,T1027.004,Compile After Delivery,2,Dynamic C# Compile,453614d8-3ba6-4147-acc0-7ec4b3e1faef,powershell
 defense-evasion,T1218.001,Compiled HTML File,1,Compiled HTML Help Local Payload,5cb87818-0d7c-4469-b7ef-9224107aebe8,command_prompt

atomics/Indexes/Indexes-CSV/windows-index.csv

@@ -66,7 +66,7 @@ defense-evasion,T1548.002,Bypass User Access Control,7,Bypass UAC using sdclt De
 defense-evasion,T1218.003,CMSTP,1,CMSTP Executing Remote Scriptlet,34e63321-9683-496b-bbc1-7566bc55e624,command_prompt
 defense-evasion,T1218.003,CMSTP,2,CMSTP Executing UAC Bypass,748cb4f6-2fb3-4e97-b7ad-b22635a09ab0,command_prompt
 defense-evasion,T1070.001,Clear Windows Event Logs,1,Clear Logs,e6abb60e-26b8-41da-8aae-0c35174b0967,command_prompt
-defense-evasion,T1070.001,Clear Windows Event Logs,2,Delete System Logs Using Clear-EventLogId,b13e9306-3351-4b4b-a6e8-477358b0b498,powershell
+defense-evasion,T1070.001,Clear Windows Event Logs,2,Delete System Logs Using Clear-EventLog,b13e9306-3351-4b4b-a6e8-477358b0b498,powershell
 defense-evasion,T1027.004,Compile After Delivery,1,Compile After Delivery using csc.exe,ffcdbd6a-b0e8-487d-927a-09127fe9a206,command_prompt
 defense-evasion,T1027.004,Compile After Delivery,2,Dynamic C# Compile,453614d8-3ba6-4147-acc0-7ec4b3e1faef,powershell
 defense-evasion,T1218.001,Compiled HTML File,1,Compiled HTML Help Local Payload,5cb87818-0d7c-4469-b7ef-9224107aebe8,command_prompt

atomics/Indexes/Indexes-Markdown/index.md

@@ -481,7 +481,7 @@
   - Atomic Test #3: Overwrite Linux Log [linux]
 - [T1070.001 Clear Windows Event Logs](../../T1070.001/T1070.001.md)
   - Atomic Test #1: Clear Logs [windows]
-  - Atomic Test #2: Delete System Logs Using Clear-EventLogId [windows]
+  - Atomic Test #2: Delete System Logs Using Clear-EventLog [windows]
 - T1078.004 Cloud Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
 - T1553.002 Code Signing [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
 - [T1027.004 Compile After Delivery](../../T1027.004/T1027.004.md)

atomics/Indexes/Indexes-Markdown/windows-index.md

@@ -142,7 +142,7 @@
 - T1574.012 COR_PROFILER [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
 - [T1070.001 Clear Windows Event Logs](../../T1070.001/T1070.001.md)
   - Atomic Test #1: Clear Logs [windows]
-  - Atomic Test #2: Delete System Logs Using Clear-EventLogId [windows]
+  - Atomic Test #2: Delete System Logs Using Clear-EventLog [windows]
 - T1553.002 Code Signing [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
 - [T1027.004 Compile After Delivery](../../T1027.004/T1027.004.md)
   - Atomic Test #1: Compile After Delivery using csc.exe [windows]

atomics/Indexes/index.yaml

@@ -22296,17 +22296,19 @@ defense-evasion:
 '
         name: command_prompt
         elevation_required: true
-    - name: Delete System Logs Using Clear-EventLogId
+    - name: Delete System Logs Using Clear-EventLog
       auto_generated_guid: b13e9306-3351-4b4b-a6e8-477358b0b498
       description: |
         Clear event logs using built-in PowerShell commands.
+        Upon successful execution, you should see the list of deleted event logs
         Upon execution, open the Security.evtx logs at C:\Windows\System32\winevt\Logs and verify that it is now empty or has very few logs in it.
       supported_platforms:
       - windows
       executor:
-        command: 'Clear-EventLog -logname Application
-
-'
+        command: |
+          $logs = Get-EventLog -List | ForEach-Object {$_.Log}
+          $logs | ForEach-Object {Clear-EventLog -LogName $_ }
+          Get-EventLog -list
         name: powershell
         elevation_required: true
   T1078.004:

atomics/T1070.001/T1070.001.md

@@ -14,7 +14,7 @@ These logs may also be cleared through other mechanisms, such as the event viewe
 
 - [Atomic Test #1 - Clear Logs](#atomic-test-1---clear-logs)
 
-- [Atomic Test #2 - Delete System Logs Using Clear-EventLogId](#atomic-test-2---delete-system-logs-using-clear-eventlogid)
+- [Atomic Test #2 - Delete System Logs Using Clear-EventLog](#atomic-test-2---delete-system-logs-using-clear-eventlog)
 
 
 <br/>
@@ -48,8 +48,9 @@ wevtutil cl #{log_name}
 <br/>
 <br/>
 
-## Atomic Test #2 - Delete System Logs Using Clear-EventLogId
+## Atomic Test #2 - Delete System Logs Using Clear-EventLog
 Clear event logs using built-in PowerShell commands.
+Upon successful execution, you should see the list of deleted event logs
 Upon execution, open the Security.evtx logs at C:\Windows\System32\winevt\Logs and verify that it is now empty or has very few logs in it.
 
 **Supported Platforms:** Windows
@@ -62,7 +63,9 @@ Upon execution, open the Security.evtx logs at C:\Windows\System32\winevt\Logs a
 
 
 ```powershell
-Clear-EventLog -logname Application
+$logs = Get-EventLog -List | ForEach-Object {$_.Log}
+$logs | ForEach-Object {Clear-EventLog -LogName $_ }
+Get-EventLog -list
 ```