search

redcanaryco / atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.
MIT License
9.56k stars 2.77k forks source link

Update T1218.yaml #2855

Closed Prakash22-k closed 1 month ago

Prakash22-k commented 2 months ago

Test Name : System Binary Proxy Execution - Wlrmdr Lolbin Use as Launcher

description: Use wlrmdr(Windows Logon Reminder executable) as a proxy binary to evade defensive countermeasures

Tested the activity in Atomic Lab machines.

NagaSivaGunturu commented 2 months ago

@Prakash22-k, If there're no dependecies for this atomic test to run, you can remove the empty fields related to Dependency check: dependency_executor_name: dependencies:

Prakash22-k commented 2 months ago

@NagaSivaGunturu , Thanks for checking. I've removed the empty fields and updated the commit.