diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index b436314f..47d1ea6c 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -47647,10 +47647,10 @@ execution: New-Item -ItemType Directory (Split-Path "#{jscript}") -Force | Out-Null Invoke-WebRequest "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.007/src/sys_info.js" -OutFile "#{jscript}" executor: - command: 'cscript "#{jscript}" > $env:TEMP\T1059.007.out.txt + command: 'cscript "#{jscript}" > %tmp%\T1059.007.out.txt ' - cleanup_command: del $env:TEMP\T1059.007.out.txt >nul 2>&1 + cleanup_command: del %tmp%\T1059.007.out.txt >nul 2>&1 name: command_prompt - name: JScript execution to gather local computer information via wscript auto_generated_guid: '0709945e-4fec-4c49-9faf-c3c292a74484' diff --git a/atomics/Indexes/windows-index.yaml b/atomics/Indexes/windows-index.yaml index afc923f0..d11b0661 100644 --- a/atomics/Indexes/windows-index.yaml +++ b/atomics/Indexes/windows-index.yaml @@ -41192,10 +41192,10 @@ execution: New-Item -ItemType Directory (Split-Path "#{jscript}") -Force | Out-Null Invoke-WebRequest "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.007/src/sys_info.js" -OutFile "#{jscript}" executor: - command: 'cscript "#{jscript}" > $env:TEMP\T1059.007.out.txt + command: 'cscript "#{jscript}" > %tmp%\T1059.007.out.txt ' - cleanup_command: del $env:TEMP\T1059.007.out.txt >nul 2>&1 + cleanup_command: del %tmp%\T1059.007.out.txt >nul 2>&1 name: command_prompt - name: JScript execution to gather local computer information via wscript auto_generated_guid: '0709945e-4fec-4c49-9faf-c3c292a74484' diff --git a/atomics/T1059.007/T1059.007.md b/atomics/T1059.007/T1059.007.md index e4af7a27..97a9e28b 100644 --- a/atomics/T1059.007/T1059.007.md +++ b/atomics/T1059.007/T1059.007.md @@ -39,12 +39,12 @@ JScript execution test, execute JScript via cscript command. When successful, sy ```cmd -cscript "#{jscript}" > $env:TEMP\T1059.007.out.txt +cscript "#{jscript}" > %tmp%\T1059.007.out.txt ``` #### Cleanup Commands: ```cmd -del $env:TEMP\T1059.007.out.txt >nul 2>&1 +del %tmp%\T1059.007.out.txt >nul 2>&1 ```