Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix T1547.001 test b051b3c0-66e7-4a81-916d-e6383bd3a669 by adding /f argument to the reg modification by reg.exe #3017

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Fix T1547.001 test b051b3c0-66e7-4a81-916d-e6383bd3a669 by adding /f argument to the reg modification by reg.exe #3017

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7da5d0d
Fix nanodump download url
Retrospected Oct 21, 2024
760f208
Fix nanodump download url
Retrospected Oct 21, 2024
cf5434a
Merge branch 'redcanaryco:master' into master
Retrospected Dec 15, 2024
739b111
Update T1547.001.yaml
Retrospected Dec 15, 2024
9978a2c
Update T1547.001.yaml
Retrospected Dec 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions atomics/T1547.001/T1547.001.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -392,8 +392,8 @@ atomic_tests:
default: calc
executor:
command: |
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd" /v StartupPrograms /t REG_SZ /d "#{malicious_app}"
cleanup_command: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd" /v StartupPrograms /t REG_SZ /d "rdpclip"
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd" /f /v StartupPrograms /t REG_SZ /d "#{malicious_app}"
cleanup_command: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd" /f /v StartupPrograms /t REG_SZ /d "rdpclip"
name: command_prompt
elevation_required: true

Expand All @@ -412,6 +412,6 @@ atomic_tests:
executor:
command: |
reg add HKLM\System\CurrentControlSet\Control\BootVerificationProgram /v ImagePath /t REG_SZ /d "#{malicious_file}"
cleanup_command: reg delete HKLM\System\CurrentControlSet\Control\BootVerificationProgram
cleanup_command: reg delete HKLM\System\CurrentControlSet\Control\BootVerificationProgram /f
name: command_prompt
elevation_required: true
Loading