redcanaryco / atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.
MIT License
9.74k stars 2.79k forks source link

Fix T1543.002.yaml #2893

Closed AlbertoPellitteri closed 2 months ago

AlbertoPellitteri commented 3 months ago

Details: Setting elevation_required field to true in tests:

These tests will enable new daemon processes and also try to reload the systemd manager. So, high privileges are required to run them.

Here is the output running the first one without privileged permissions:

Screenshot 2024-08-02 alle 10 55 17

Adding the elevation_required field would fix this issue.

Testing: Tested on Ubuntu.