From 85a40eed42e3956faabc8edbbc93c9b9bc2bb0a8 Mon Sep 17 00:00:00 2001 From: Carrie Roberts <clr2of8@gmail.com> Date: Wed, 25 Oct 2023 21:32:41 -0600 Subject: [PATCH] restore original guid --- atomics/T1505.005/T1505.005.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/atomics/T1505.005/T1505.005.yaml b/atomics/T1505.005/T1505.005.yaml index 2222a7dbc0..a940bcfb30 100644 --- a/atomics/T1505.005/T1505.005.yaml +++ b/atomics/T1505.005/T1505.005.yaml @@ -2,6 +2,7 @@ attack_technique: T1505.005 display_name: 'Server Software Component: Terminal Services DLL' atomic_tests: - name: Simulate Patching termsrv.dll + auto_generated_guid: 0b2eadeb-4a64-4449-9d43-3d999f4a317b description: | Simulates patching of termsrv.dll by making a benign change to the file and replacing it with the original afterwards. Before we can make the modifications we need to take ownership of the file and grant ourselves the necessary permissions.