From f45fd9f3126979919241cdaf8dc428bfac322bbd Mon Sep 17 00:00:00 2001 From: Carrie Roberts Date: Tue, 6 Sep 2022 21:51:44 -0500 Subject: [PATCH] remove duplicate test (#2123) --- atomics/T1218/T1218.yaml | 17 +---------------- 1 file changed, 1 insertion(+), 16 deletions(-) diff --git a/atomics/T1218/T1218.yaml b/atomics/T1218/T1218.yaml index 24935cf3..de24d1a3 100644 --- a/atomics/T1218/T1218.yaml +++ b/atomics/T1218/T1218.yaml @@ -30,21 +30,6 @@ atomic_tests: mavinject.exe #{process_id} /INJECTRUNNING #{dll_payload} name: command_prompt elevation_required: true -- name: SyncAppvPublishingServer - Execute arbitrary PowerShell code - auto_generated_guid: d590097e-d402-44e2-ad72-2c6aa1ce78b1 - description: | - Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe. Requires Windows 10. - supported_platforms: - - windows - input_arguments: - powershell_code: - description: PowerShell code to execute - type: String - default: Start-Process calc.exe - executor: - command: | - SyncAppvPublishingServer.exe "n; #{powershell_code}" - name: command_prompt - name: Register-CimProvider - Execute evil dll auto_generated_guid: ad2c17ed-f626-4061-b21e-b9804a6f3655 description: | @@ -333,4 +318,4 @@ atomic_tests: cleanup_command: | del %TEMP%\ie4uinit.exe >nul 2>&1 del %TEMP%\ieuinit.inf >nul 2>&1 - name: command_prompt \ No newline at end of file + name: command_prompt