From fb8714cc67f78d5a78dc267be139362a29921b7e Mon Sep 17 00:00:00 2001
From: mgonzcast <63349279+mgonzcast@users.noreply.github.com>
Date: Thu, 23 Oct 2025 18:10:15 +0200
Subject: [PATCH] Fix killing sshd session in T1070.004 in oilrig.yaml

To kill the sshd tunnel, you need to grep sshd-session

Signed-off-by: mgonzcast <63349279+mgonzcast@users.noreply.github.com>
---
 ManagedServices/oilrig/Emulation_Plan/yaml/oilrig.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ManagedServices/oilrig/Emulation_Plan/yaml/oilrig.yaml b/ManagedServices/oilrig/Emulation_Plan/yaml/oilrig.yaml
index 747e6977a..f9f48498d 100644
--- a/ManagedServices/oilrig/Emulation_Plan/yaml/oilrig.yaml
+++ b/ManagedServices/oilrig/Emulation_Plan/yaml/oilrig.yaml
@@ -818,7 +818,7 @@
           xdotool key --window "$rdp_window" Return;
           sleep 2;
           
-          kill $(ps aux | grep "sshd: #{caldera.user.name}" | grep -v priv | grep -v grep | awk '{print $2}')
+          kill $(ps aux | grep "sshd-session: #{caldera.user.name}" | grep -v priv | grep -v grep | awk '{print $2}')
 
 - id: d9c9a941-c0e8-4eed-8cc3-6511ad5b9e15
   name: OilRig Cleanup on Gosta