security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

small title correction (#2226)

Browse Source
This commit is contained in:
Carrie Roberts
2022-11-10 12:00:37 -05:00
committed by GitHub
parent 2a798d98d1
commit ebe511a738
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1546/T1546.yaml
+2 -2
View File
@@ -45,7 +45,7 @@ atomic_tests:
Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Command Processor" -Name "AutoRun" -ErrorAction Ignore
name: powershell
elevation_required: true
- name: HKCU - Persistence using CommandProcessor AutoRun key (With Elevation)
- name: HKCU - Persistence using CommandProcessor AutoRun key (Without Elevation)
auto_generated_guid: 36b8dbf9-59b1-4e9b-a3bb-36e80563ef01
description: |-
An adversary may abuse the CommandProcessor AutoRun registry key to persist. Every time cmd.exe is executed, the command defined in the AutoRun key also gets executed.
@@ -66,4 +66,4 @@ atomic_tests:
New-ItemProperty -Path $path -Name "AutoRun" -Value "#{command}" -PropertyType "String"
cleanup_command: |-
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Command Processor" -Name "AutoRun" -ErrorAction Ignore
name: powershell
name: powershell