diff --git a/atomics/T1505.005/T1505.005.yaml b/atomics/T1505.005/T1505.005.yaml index f3fb308fa6..4a913ab7a5 100644 --- a/atomics/T1505.005/T1505.005.yaml +++ b/atomics/T1505.005/T1505.005.yaml @@ -27,7 +27,7 @@ atomic_tests: name: powershell - name: Modify Terminal Services DLL Path - auto_generated_guid: 18136e38-0530-49b2-b309-eed173787471 + auto_generated_guid: 18136e38-0530-49b2-b309-eed173787471 description: This atomic test simulates the modification of the ServiceDll value in HKLM\System\CurrentControlSet\services\TermService\Parameters. This technique may be leveraged by adversaries to establish persistence by loading a patched version of the DLL containing malicious code. supported_platforms: - windows @@ -56,9 +56,5 @@ atomic_tests: } else { Write-Host "Registry key not found. Make sure the 'TermService\Parameters' key exists." } - cleanup_command: Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\services\TermService\Parameters" -Name "ServiceDll" -Value "C:\Windows\System32\termsrv.dll" - name: powershell - - elevation_required: true