diff --git a/atomics/T1012/T1012.yaml b/atomics/T1012/T1012.yaml index 0b84f660..255a7d8f 100644 --- a/atomics/T1012/T1012.yaml +++ b/atomics/T1012/T1012.yaml @@ -25,7 +25,6 @@ atomic_tests: name: command_prompt elevation_required: true command: | - powershell.exe New-Item -ItemType Directory -Name ART1012 -Path $env:USERPROFILE\AppData\Local\Temp\ reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce @@ -45,8 +44,3 @@ atomic_tests: reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run reg query HKLM\system\currentcontrolset\services /s | findstr ImagePath 2>nul | findstr /Ri ".*\.sys$" reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run - reg save HKLM\Security $env:USERPROFILE\AppData\Local\Temp\ART1012\security.hive" - reg save HKLM\System $env:USERPROFILE\AppData\Local\Temp\ART1012\system.hive" - reg save HKLM\SAM $env:USERPROFILE\AppData\Local\Temp\ART1012\sam.hive" - cleanup_command: | - rmdir /q /s $env:USERPROFILE\AppData\Local\Temp\ART1012\ diff --git a/atomics/T1016/T1016.yaml b/atomics/T1016/T1016.yaml index 7c954767..ff8720f7 100644 --- a/atomics/T1016/T1016.yaml +++ b/atomics/T1016/T1016.yaml @@ -75,10 +75,24 @@ atomic_tests: The path to a text file containing ports to be scanned, one port per line. The default list uses the top 128 ports as defined by Nmap. type: Path default: PathToAtomicsFolder\T1016\src\top-128.txt + portfile_url: + description: URL to top-128.txt + type: Url + default: https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1016/src/top-128.txt output_file: description: Path of file to write port scan results type: Path default: $env:USERPROFILE\Desktop\open-ports.txt + + dependency_executor_name: powershell + dependencies: + - description: | + Test requires #{port_file} to exist + prereq_command: | + if (Test-Path "#{port_file}") {exit 0} else {exit 1} + get_prereq_command: | + Invoke-WebRequest "#{portfile_url}" -OutFile "#{port_file}" + executor: name: powershell elevation_required: false