Add tests to T1222 - Githubissues

redcanaryco / atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

MIT License

9.79k stars 2.8k forks source link

Add tests to T1222 #2980

Open MATTANDERS0N opened 5 days ago

MATTANDERS0N commented 5 days ago

Details: Add two new tests for different methods of modifying SymLinkEvaluation settings (remote).

Testing:

Associated Issues:

patel-bhavin commented 2 days ago

@MATTANDERS0N : what a neat atomic! Thanks for contributing this to ART! Can you please atttach the screenshot of execution and cleanup of this atomic?