search

redcanaryco / atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.
MIT License
9.74k stars 2.79k forks source link

Problem: A mistake in cleanup_command of T1547.005 #2914

Closed Sunr1seSun closed 1 month ago

Sunr1seSun commented 2 months ago

What did you do?

Run $oldvalue = $(Get-ItemPropertyValue -Path "HKLM:\System\CurrentControlSet\Control\Lsa\OSConfig" -Name 'Security Packages old' | Select-Object -ExpandProperty 'Security Packages old');

What did you expect to happen?

Get $oldvalue

What happened instead?

The result obtained by Get-ItemPropertyValue is already a value, and the property cannot be obtained by Select-Object further more. If you want to keep it the same as above, you should use Get-ItemProperty.

github-actions[bot] commented 1 month ago

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

github-actions[bot] commented 1 month ago

This issue was closed because it has been stalled for 5 days with no activity.