From 9af1dd8675cc7a8ec318b816b79459f6f0794c2c Mon Sep 17 00:00:00 2001 From: nmontesinoc Date: Thu, 9 May 2024 05:41:25 +0200 Subject: [PATCH] Adding codebox so '\' characters shows up well in Markdown (#2766) Co-authored-by: Nico Co-authored-by: Hare Sudhan --- atomics/T1070.004/T1070.004.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/atomics/T1070.004/T1070.004.yaml b/atomics/T1070.004/T1070.004.yaml index 999eef9c24..b9f14b28c9 100644 --- a/atomics/T1070.004/T1070.004.yaml +++ b/atomics/T1070.004/T1070.004.yaml @@ -178,7 +178,7 @@ atomic_tests: - name: Delete Prefetch File auto_generated_guid: 36f96049-0ad7-4a5f-8418-460acaeb92fb description: | - Delete a single prefetch file. Deletion of prefetch files is a known anti-forensic technique. To verify execution, Run "(Get-ChildItem -Path "$Env:SystemRoot\prefetch\*.pf" | Measure-Object).Count" + Delete a single prefetch file. Deletion of prefetch files is a known anti-forensic technique. To verify execution, Run `(Get-ChildItem -Path "$Env:SystemRoot\prefetch\*.pf" | Measure-Object).Count` before and after the test to verify that the number of prefetch files decreases by 1. supported_platforms: - windows