From 80e3f67e445e46a07c7cae64c316d2c845bee332 Mon Sep 17 00:00:00 2001 From: Wietze Date: Fri, 5 Nov 2021 19:33:48 +0000 Subject: [PATCH] Applying more specific subtechniques to At/Schtasks, closes LOLBAS-Project/LOLBAS#113 --- yml/OSBinaries/At.yml | 2 +- yml/OSBinaries/Schtasks.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/yml/OSBinaries/At.yml b/yml/OSBinaries/At.yml index 55f13da..1ea7e7f 100644 --- a/yml/OSBinaries/At.yml +++ b/yml/OSBinaries/At.yml @@ -9,7 +9,7 @@ Commands: Usecase: Create a recurring task, to eg. to keep reverse shell session(s) alive Category: Execute Privileges: Local Admin - MitreID: T1053 + MitreID: T1053.002 OperatingSystem: Windows 7 or older Full_Path: - Path: C:\WINDOWS\System32\At.exe diff --git a/yml/OSBinaries/Schtasks.yml b/yml/OSBinaries/Schtasks.yml index e1d3a09..fbfe04a 100644 --- a/yml/OSBinaries/Schtasks.yml +++ b/yml/OSBinaries/Schtasks.yml @@ -9,7 +9,7 @@ Commands: Usecase: Create a recurring task, to eg. to keep reverse shell session(s) alive Category: Execute Privileges: User - MitreID: T1053 + MitreID: T1053.005 OperatingSystem: Windows Full_Path: - Path: c:\windows\system32\schtasks.exe