Update T1012.yaml (#2959)

* Update T1012.yaml New atomic added. * Update T1012.yaml Command structre fixed * Update T1012.yaml Accidentally put a space at the beginning of the file. --------- Co-authored-by: Bhavin Patel <[email protected]>
redcanaryco · Oct 25, 2024 · d93cb37 · d93cb37
1 parent 93a6223
commit d93cb37
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/atomics/T1012/T1012.yaml b/atomics/T1012/T1012.yaml
@@ -126,3 +126,12 @@ atomic_tests:
       reg.exe query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64
     name: command_prompt
     elevation_required: true
+- name: Inspect SystemStartOptions Value in Registry
+  description: The objective of this test is to query the SystemStartOptions key under HKLM\SYSTEM\CurrentControlSet\Control in the Windows registry. This action could be used to uncover specific details about how the system is configured to start, potentially aiding in understanding boot parameters or identifying security-related settings.
+    key is.
+  supported_platforms:
+  - windows
+  executor:
+    name: command_prompt
+    command: |
+      reg.exe query HKLM\SYSTEM\CurrentControlSet\Control /v SystemStartOptions