Release ER Production RTAs to DR (#2270)
(cherry picked from commit 0358ec9d9a)
This commit is contained in:
committed by
github-actions[bot]
parent
6c9881027b
commit
1dfc8ca817
@@ -11,12 +11,23 @@ import os
|
||||
import time
|
||||
|
||||
from . import common
|
||||
from . import RtaMetadata
|
||||
|
||||
|
||||
metadata = RtaMetadata(
|
||||
uuid="2ab62c28-1abb-4ac5-a16d-2f4f75d01d02",
|
||||
platforms=["windows"],
|
||||
endpoint=[],
|
||||
siem=[{"rule_id": "afcce5ad-65de-4ed2-8516-5e093d3ac99a", "rule_name": "Local Scheduled Task Creation"}],
|
||||
techniques=["T1053"],
|
||||
)
|
||||
|
||||
|
||||
VBS = common.get_path("bin", "persistent_script.vbs")
|
||||
NAME = "rta-vbs-persistence"
|
||||
|
||||
|
||||
@common.requires_os(common.WINDOWS)
|
||||
@common.requires_os(metadata.platforms)
|
||||
@common.dependencies(common.PS_EXEC, VBS)
|
||||
def main():
|
||||
common.log("Persistent Scripts")
|
||||
@@ -26,7 +37,7 @@ def main():
|
||||
return 1
|
||||
|
||||
# Remove any existing profiles
|
||||
user_profile = os.environ['USERPROFILE']
|
||||
user_profile = os.environ["USERPROFILE"]
|
||||
log_file = os.path.join(user_profile, NAME + ".log")
|
||||
|
||||
# Remove log file if exists
|
||||
|
||||
Reference in New Issue
Block a user