T1012 input args and cleanup (#804)

* T1012 input args and cleanup

* Removed file write functionality

* fixed missing > in command

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>

atomics/T1012/T1012.yaml

@@ -25,7 +25,6 @@ atomic_tests:
     name: command_prompt
     elevation_required: true
     command: |
-      powershell.exe New-Item -ItemType Directory -Name ART1012 -Path $env:USERPROFILE\AppData\Local\Temp\
       reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows"
       reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
       reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
@@ -45,8 +44,3 @@ atomic_tests:
       reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
       reg query HKLM\system\currentcontrolset\services /s | findstr ImagePath 2>nul | findstr /Ri ".*\.sys$"
       reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
-      reg save HKLM\Security $env:USERPROFILE\AppData\Local\Temp\ART1012\security.hive"
-      reg save HKLM\System $env:USERPROFILE\AppData\Local\Temp\ART1012\system.hive"
-      reg save HKLM\SAM $env:USERPROFILE\AppData\Local\Temp\ART1012\sam.hive"
-    cleanup_command: |
-      rmdir /q /s $env:USERPROFILE\AppData\Local\Temp\ART1012\

atomics/T1016/T1016.yaml

@@ -75,10 +75,24 @@ atomic_tests:
         The path to a text file containing ports to be scanned, one port per line. The default list uses the top 128 ports as defined by Nmap.
       type: Path
       default: PathToAtomicsFolder\T1016\src\top-128.txt
+    portfile_url:
+      description: URL to top-128.txt
+      type: Url
+      default: https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1016/src/top-128.txt
     output_file:
       description: Path of file to write port scan results
       type: Path
       default: $env:USERPROFILE\Desktop\open-ports.txt
+  
+  dependency_executor_name: powershell
+  dependencies:
+    - description: |
+        Test requires #{port_file} to exist
+      prereq_command: |
+        if (Test-Path "#{port_file}") {exit 0} else {exit 1}
+      get_prereq_command: |
+        Invoke-WebRequest "#{portfile_url}" -OutFile "#{port_file}"
+  
   executor:
     name: powershell
     elevation_required: false