From ebe511a738b0c62a210e9a019ba71f446cd359c3 Mon Sep 17 00:00:00 2001 From: Carrie Roberts Date: Thu, 10 Nov 2022 12:00:37 -0500 Subject: [PATCH] small title correction (#2226) --- atomics/T1546/T1546.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/atomics/T1546/T1546.yaml b/atomics/T1546/T1546.yaml index f81e303c..09e69b46 100644 --- a/atomics/T1546/T1546.yaml +++ b/atomics/T1546/T1546.yaml @@ -45,7 +45,7 @@ atomic_tests: Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Command Processor" -Name "AutoRun" -ErrorAction Ignore name: powershell elevation_required: true -- name: HKCU - Persistence using CommandProcessor AutoRun key (With Elevation) +- name: HKCU - Persistence using CommandProcessor AutoRun key (Without Elevation) auto_generated_guid: 36b8dbf9-59b1-4e9b-a3bb-36e80563ef01 description: |- An adversary may abuse the CommandProcessor AutoRun registry key to persist. Every time cmd.exe is executed, the command defined in the AutoRun key also gets executed. @@ -66,4 +66,4 @@ atomic_tests: New-ItemProperty -Path $path -Name "AutoRun" -Value "#{command}" -PropertyType "String" cleanup_command: |- Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Command Processor" -Name "AutoRun" -ErrorAction Ignore - name: powershell \ No newline at end of file + name: powershell