From e878c66e6f10698d80cb53c20d6a579b3d6951fb Mon Sep 17 00:00:00 2001 From: Conor Richard Date: Sat, 17 Sep 2022 07:55:16 -0400 Subject: [PATCH] Cleaning YAML, updated new category Tamper --- yml/OSBinaries/fsutil.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/yml/OSBinaries/fsutil.yml b/yml/OSBinaries/fsutil.yml index c784b26..0955c1f 100644 --- a/yml/OSBinaries/fsutil.yml +++ b/yml/OSBinaries/fsutil.yml @@ -7,10 +7,9 @@ Commands: - Command: fsutil file setZeroData offset=0 length=9999999999 C:\Windows\Temp\payload.dll Description: Zero out a file Usecase: Can be used to forensically erase a file - Category: Forensics + Category: Tamper Privileges: User MitreID: T1485 - MitreLink: https://attack.mitre.org/techniques/T1485/ OperatingSystem: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10 Full_Path: - Path: C:\Windows\System32\fsutil.exe @@ -21,4 +20,3 @@ Detection: Acknowledgement: - Person: Elliot Killick Handle: '@elliotkillick' ----