Fix T1547.001 test b051b3c0-66e7-4a81-916d-e6383bd3a669 by adding /f …

…argument to the reg modification by reg.exe (#3017) Co-authored-by: Bhavin Patel <[email protected]>
redcanaryco · Dec 18, 2024 · f308db7 · f308db7
1 parent f6b46af
commit f308db7
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/atomics/T1547.001/T1547.001.yaml b/atomics/T1547.001/T1547.001.yaml
@@ -392,8 +392,8 @@ atomic_tests:
       default: calc
   executor:
     command: |
-      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd" /v StartupPrograms /t REG_SZ /d "#{malicious_app}"
-    cleanup_command: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd" /v StartupPrograms /t REG_SZ /d "rdpclip"
+      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd" /f /v StartupPrograms /t REG_SZ /d "#{malicious_app}"
+    cleanup_command: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd" /f /v StartupPrograms /t REG_SZ /d "rdpclip"
     name: command_prompt    
     elevation_required: true
 
@@ -412,6 +412,6 @@ atomic_tests:
   executor:
     command: |
       reg add HKLM\System\CurrentControlSet\Control\BootVerificationProgram /v ImagePath /t REG_SZ /d "#{malicious_file}"
-    cleanup_command: reg delete HKLM\System\CurrentControlSet\Control\BootVerificationProgram
+    cleanup_command: reg delete HKLM\System\CurrentControlSet\Control\BootVerificationProgram /f
     name: command_prompt    
     elevation_required: true