Problem: A mistake in cleanup_command of T1547.005

[Sunr1seSun]

What did you do?

Run $oldvalue = $(Get-ItemPropertyValue -Path "HKLM:\System\CurrentControlSet\Control\Lsa\OSConfig" -Name 'Security Packages old' | Select-Object -ExpandProperty 'Security Packages old');

What did you expect to happen?

Get $oldvalue

What happened instead?

The result obtained by Get-ItemPropertyValue is already a value, and the property cannot be obtained by Select-Object further more. If you want to keep it the same as above, you should use Get-ItemProperty.

[github-actions]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.