diff --git a/atomics/T1037/T1037.yaml b/atomics/T1037/T1037.yaml index 063e21e6..4251c2c1 100644 --- a/atomics/T1037/T1037.yaml +++ b/atomics/T1037/T1037.yaml @@ -21,7 +21,7 @@ atomic_tests: elevation_required: false command: | REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_MULTI_SZ /d "#{script_command}" - REM cleanup command below. + cleanup_command: | REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f - name: Logon Scripts - Mac