Merge branch 'master' into clr2of8-patch-1

redcanaryco · Feb 24, 2025 · 2509812 · 2509812
2 parents caeca42 + 787d043
commit 2509812
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 2 deletions.
diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml
@@ -18369,6 +18369,7 @@ defense-evasion:
           Dismount-DiskImage -ImagePath "#{path_of_iso}" | Out-Null
           Stop-process -name "hello" -Force -ErrorAction ignore
         name: powershell
+        elevation_required: true
     - name: Remove the Zone.Identifier alternate data stream
       auto_generated_guid: 64b12afc-18b8-4d3f-9eab-7f6cae7c73f9
       description: |

diff --git a/atomics/Indexes/windows-index.yaml b/atomics/Indexes/windows-index.yaml
@@ -14987,6 +14987,7 @@ defense-evasion:
           Dismount-DiskImage -ImagePath "#{path_of_iso}" | Out-Null
           Stop-process -name "hello" -Force -ErrorAction ignore
         name: powershell
+        elevation_required: true
     - name: Remove the Zone.Identifier alternate data stream
       auto_generated_guid: 64b12afc-18b8-4d3f-9eab-7f6cae7c73f9
       description: |

diff --git a/atomics/T1486/T1486.yaml b/atomics/T1486/T1486.yaml
@@ -333,7 +333,7 @@ atomic_tests:
       echo "If you' re indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:" >> $env:Userprofile\Desktop\akira_readme.txt
       echo "" >> $env:Userprofile\Desktop\akira_readme.txt
       echo "1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/." >> $env:Userprofile\Desktop\akira_readme.txt
-      echo "2. Paste this link — https://akira.onion" >> $env:Userprofile\Desktop\akira_readme.txt
+      echo "2. Paste this link - https://akira.onion" >> $env:Userprofile\Desktop\akira_readme.txt
       echo "3. Use this code - - to log into our chat." >> $env:Userprofile\Desktop\akira_readme.txt
       echo "" >> $env:Userprofile\Desktop\akira_readme.txt
       echo "Keep in mind that the faster you will get in touch, the less damage we cause" >> $env:Userprofile\Desktop\akira_readme.txt

diff --git a/atomics/T1553.005/T1553.005.md b/atomics/T1553.005/T1553.005.md
@@ -91,7 +91,7 @@ ISO provided by:https://twitter.com/mattifestation/status/1398323532988399620 Re
 | path_of_iso | Path to ISO file | path | PathToAtomicsFolder&#92;T1553.005&#92;bin&#92;FeelTheBurn.iso|
 
 
-#### Attack Commands: Run with `powershell`! 
+#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 
 
 
 ```powershell