search

redcanaryco / atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.
MIT License
9.79k stars 2.8k forks source link

Update T1012.yaml #2959

Closed krdmnbrk closed 3 weeks ago

krdmnbrk commented 1 month ago

New atomic added.

Details: This atomic test adds a new method to query the SystemStartOptions registry key located under HKLM\SYSTEM\CurrentControlSet\Control. The purpose of this test is to simulate a technique that an attacker might use to retrieve system startup configurations, which could provide insight into how the system boots or is configured.

Testing: The test was executed locally on a Windows system to ensure that the command correctly retrieves the value of the SystemStartOptionskey. Successful execution returned the current configuration value without any errors.

Associated Issues: No associated issues linked to this pull request.

patel-bhavin commented 3 weeks ago

Thank you for contributing this atomic! Can you perhaps attach a screenshot of execution of this atomic, that way we can verify if executes correctly!

krdmnbrk commented 3 weeks ago

@patel-bhavin, I attached a screenshot that taken from my local windows. image

patel-bhavin commented 3 weeks ago

This is great! thank you for contributing this atomic!