diff --git a/atomics/T1490/T1490.yaml b/atomics/T1490/T1490.yaml index 4b20ffb81b..d923bf5ea7 100644 --- a/atomics/T1490/T1490.yaml +++ b/atomics/T1490/T1490.yaml @@ -147,7 +147,7 @@ atomic_tests: elevation_required: true - name: "Modify VSS Service Permissions" - auto_generated_guid: "d6a0c593-be3c-41b9-913d-763b1d3bc3eb" + auto_generated_guid: a4420f93-5386-4290-b780-f4f66abc7070 description: | This atomic test alters the security settings of the Volume Shadow Copy Service (VSS) by modifying its permissions, potentially impacting system recovery operations. The specific permissions set by the command are as follows: - Deny Generic All (GA) permissions to Network Users (NU) diff --git a/atomics/T1562.010/T1562.010.yaml b/atomics/T1562.010/T1562.010.yaml index b09f203e78..b5d95f1132 100644 --- a/atomics/T1562.010/T1562.010.yaml +++ b/atomics/T1562.010/T1562.010.yaml @@ -80,6 +80,7 @@ atomic_tests: echo "" | "#{plink_file}" "#{vm_host}" -ssh -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}" name: command_prompt - name: PowerShell Version 2 Downgrade + auto_generated_guid: 47c96489-2f55-4774-a6df-39faff428f6f description: Executes outdated PowerShell Version 2 which does not support security features like AMSI. By default the atomic will attempt to execute the cmdlet Invoke-Mimikatz whether it exists or not, as this cmdlet will be blocked by AMSI when active. supported_platforms: - windows diff --git a/atomics/used_guids.txt b/atomics/used_guids.txt index 9569c60e1e..e464c20d20 100644 --- a/atomics/used_guids.txt +++ b/atomics/used_guids.txt @@ -1551,3 +1551,6 @@ ba38e193-37a6-4c41-b214-61b33277fe36 444ff124-4c83-4e28-8df6-6efd3ece6bd4 44b68e11-9da2-4d45-a0d9-893dabd60f30 c9207f3e-213d-4cc7-ad2a-7697a7237df9 +d6a0c593-be3c-41b9-913d-763b1d3bc3eb +a4420f93-5386-4290-b780-f4f66abc7070 +47c96489-2f55-4774-a6df-39faff428f6f