From 9343ac2b4226761ebba133ca5139ba16a7f51d5e Mon Sep 17 00:00:00 2001 From: Jake Humphries Date: Mon, 5 Feb 2024 22:49:08 +0000 Subject: [PATCH] Removing REM from 95b25212-91a7-42ff-9613-124aca6845a8 due to incorrect execution --- atomics/T1112/T1112.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/atomics/T1112/T1112.yaml b/atomics/T1112/T1112.yaml index d147a6370d..e5ac6addaf 100644 --- a/atomics/T1112/T1112.yaml +++ b/atomics/T1112/T1112.yaml @@ -507,7 +507,6 @@ atomic_tests: reg add HKCU\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging /v EnableScriptBlockLogging /t REG_DWORD /d 0 /f reg add HKCU\Software\Policies\Microsoft\Windows\PowerShell\Transcription /v EnableTranscripting /t REG_DWORD /d 0 /f reg add HKCU\Software\Policies\Microsoft\Windows\PowerShell /v EnableScripts /t REG_DWORD /d 0 /f - REM do a little cleanup immediately to avoid execution issues with later tests reg delete HKCU\Software\Policies\Microsoft\Windows\PowerShell /v EnableScripts /f >nul 2>&1 cleanup_command: | reg delete HKCU\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging /v EnableModuleLogging /f >nul 2>&1