diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 691378ed..9312889d 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -7481,6 +7481,7 @@ defense-evasion: command: 'docker container prune -f && sudo truncate -s 0 /var/lib/docker/containers/*/*-json.log ' + elevation_required: true - name: Prevent Powershell History Logging auto_generated_guid: 2f898b81-3e97-4abb-bc3f-a95138988370 description: 'Prevents Powershell history @@ -100160,6 +100161,7 @@ discovery: sudo lsmod | grep -i "virtio_pci\|virtio_net" sudo lsmod | grep -i "hv_vmbus\|hv_blkvsc\|hv_netvsc\|hv_utils\|hv_storvsc" name: bash + elevation_required: true - name: FreeBSD VM Check via Kernel Modules auto_generated_guid: eefe6a49-d88b-41d8-8fc2-b46822da90d3 description: 'Identify virtual machine host kernel modules. diff --git a/atomics/Indexes/linux-index.yaml b/atomics/Indexes/linux-index.yaml index aec6a3a1..421f56e2 100644 --- a/atomics/Indexes/linux-index.yaml +++ b/atomics/Indexes/linux-index.yaml @@ -4467,6 +4467,7 @@ defense-evasion: command: 'docker container prune -f && sudo truncate -s 0 /var/lib/docker/containers/*/*-json.log ' + elevation_required: true T1202: technique: x_mitre_platforms: @@ -60011,6 +60012,7 @@ discovery: sudo lsmod | grep -i "virtio_pci\|virtio_net" sudo lsmod | grep -i "hv_vmbus\|hv_blkvsc\|hv_netvsc\|hv_utils\|hv_storvsc" name: bash + elevation_required: true - name: FreeBSD VM Check via Kernel Modules auto_generated_guid: eefe6a49-d88b-41d8-8fc2-b46822da90d3 description: 'Identify virtual machine host kernel modules. diff --git a/atomics/T1070.003/T1070.003.md b/atomics/T1070.003/T1070.003.md index 45a967db..14d67fc6 100644 --- a/atomics/T1070.003/T1070.003.md +++ b/atomics/T1070.003/T1070.003.md @@ -365,7 +365,7 @@ Clears Docker container logs using the Docker CLI and the truncate command, remo -#### Attack Commands: Run with `bash`! +#### Attack Commands: Run with `bash`! Elevation Required (e.g. root or admin) ```bash diff --git a/atomics/T1082/T1082.md b/atomics/T1082/T1082.md index 250b0890..4bfe391f 100644 --- a/atomics/T1082/T1082.md +++ b/atomics/T1082/T1082.md @@ -226,7 +226,7 @@ Identify virtual machine guest kernel modules. This technique is used by the Pup -#### Attack Commands: Run with `bash`! +#### Attack Commands: Run with `bash`! Elevation Required (e.g. root or admin) ```bash