correct registry value, see issue #2362 (#2404)

redcanaryco · Apr 27, 2023 · 7b710ce · 7b710ce
1 parent 60a4735
commit 7b710ce
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/atomics/T1562.001/T1562.001.yaml b/atomics/T1562.001/T1562.001.yaml
@@ -704,7 +704,7 @@ atomic_tests:
   - windows
   executor:
     command: |
-      New-ItemProperty "HKCU:\Software\Policies\Microsoft\Windows\OOBE" -Name DisablePrivacyExperience -PropertyType DWord -Value 0 -Force
+      New-ItemProperty "HKCU:\Software\Policies\Microsoft\Windows\OOBE" -Name DisablePrivacyExperience -PropertyType DWord -Value 1 -Force
     cleanup_command: |
       Remove-ItemProperty "HKCU:\Software\Policies\Microsoft\Windows\OOBE" -Name DisablePrivacyExperience -Force -ErrorAction Ignore
     name: powershell
@@ -893,4 +893,4 @@ atomic_tests:
       reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /f
       reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /f
     name: powershell
-    elevation_required: true
+    elevation_required: true