diff --git a/atomics/T1569.002/T1569.002.yaml b/atomics/T1569.002/T1569.002.yaml index df03c297..e42d05e3 100644 --- a/atomics/T1569.002/T1569.002.yaml +++ b/atomics/T1569.002/T1569.002.yaml @@ -20,7 +20,7 @@ atomic_tests: default: '%COMSPEC% /c powershell.exe -nop -w hidden -command New-Item -ItemType File C:\art-marker.txt' executor: command: | - sc.exe create #{service_name} binPath= #{executable_command} + sc.exe create #{service_name} binPath= "#{executable_command}" sc.exe start #{service_name} sc.exe delete #{service_name} name: command_prompt @@ -56,4 +56,4 @@ atomic_tests: executor: command: | #{psexec_exe} \\#{remote_host} "C:\Windows\System32\calc.exe" - name: powershell \ No newline at end of file + name: powershell