diff --git a/atomics/T1012/T1012.yaml b/atomics/T1012/T1012.yaml index cbf1527c..952e5b28 100644 --- a/atomics/T1012/T1012.yaml +++ b/atomics/T1012/T1012.yaml @@ -5,17 +5,11 @@ atomic_tests: auto_generated_guid: 8f7578c4-9863-4d83-875c-a565573bbdf0 description: | Query Windows Registry. - Upon successful execution, cmd.exe will perform multiple reg queries. Some will succeed and others will fail (dependent upon OS). - References: - https://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order - https://blog.cylance.com/windows-registry-persistence-part-1-introduction-attack-phases-and-windows-services - http://www.handgrep.se/repository/cheatsheets/postexploitation/WindowsPost-Exploitation.pdf - https://www.offensive-security.com/wp-content/uploads/2015/04/wp.Registry_Quick_Find_Chart.en_us.pdf supported_platforms: - windows