Release ER Production RTAs to DR (#2270)

(cherry picked from commit 0358ec9d9a)
This commit is contained in:
Mika Ayenson
2022-09-08 12:50:39 -04:00
committed by github-actions[bot]
parent 6c9881027b
commit 1dfc8ca817
308 changed files with 9859 additions and 367 deletions
+13 -2
View File
@@ -11,12 +11,23 @@ import os
import time
from . import common
from . import RtaMetadata
metadata = RtaMetadata(
uuid="2ab62c28-1abb-4ac5-a16d-2f4f75d01d02",
platforms=["windows"],
endpoint=[],
siem=[{"rule_id": "afcce5ad-65de-4ed2-8516-5e093d3ac99a", "rule_name": "Local Scheduled Task Creation"}],
techniques=["T1053"],
)
VBS = common.get_path("bin", "persistent_script.vbs")
NAME = "rta-vbs-persistence"
@common.requires_os(common.WINDOWS)
@common.requires_os(metadata.platforms)
@common.dependencies(common.PS_EXEC, VBS)
def main():
common.log("Persistent Scripts")
@@ -26,7 +37,7 @@ def main():
return 1
# Remove any existing profiles
user_profile = os.environ['USERPROFILE']
user_profile = os.environ["USERPROFILE"]
log_file = os.path.join(user_profile, NAME + ".log")
# Remove log file if exists