From 181672267b1846df0f77bcabbd53e56dc026446f Mon Sep 17 00:00:00 2001 From: Conor Richard Date: Sat, 17 Sep 2022 08:09:27 -0400 Subject: [PATCH] Adding quotes since the ":" falls at the end to fix linting error --- yml/OSBinaries/fsutil.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/yml/OSBinaries/fsutil.yml b/yml/OSBinaries/fsutil.yml index 256c4a7..c506561 100644 --- a/yml/OSBinaries/fsutil.yml +++ b/yml/OSBinaries/fsutil.yml @@ -4,14 +4,14 @@ Description: File System Utility Author: 'Elliot Killick' Created: '2021-08-16' Commands: - - Command: fsutil file setZeroData offset=0 length=9999999999 C:\Windows\Temp\payload.dll + - Command: fsutil.exe file setZeroData offset=0 length=9999999999 C:\Windows\Temp\payload.dll Description: Zero out a file Usecase: Can be used to forensically erase a file Category: Tamper Privileges: User MitreID: T1485 OperatingSystem: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10 - - Command: fsutil.exe usn deletejournal /d c: + - Command: 'fsutil.exe usn deletejournal /d c:' Description: Delete the USN journal volume to hide file creation activity Usecase: Can be used to hide file creation activity Category: Tamper