diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 265004f1..9bcbacac 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -101994,8 +101994,8 @@ initial-access: - name: Word spawned a command shell and used an IP address in the command line auto_generated_guid: cbb6799a-425c-4f83-9194-5447a909d67f description: | - Word spawning a command prompt then running a command with an IP address in the command line is an indiciator of malicious activity. - Upon execution, CMD will be lauchned and ping 8.8.8.8 + Word spawning a command prompt then running a command with an IP address in the command line is an indicator of malicious activity. + Upon execution, CMD will be launched and ping 8.8.8.8. supported_platforms: - windows input_arguments: diff --git a/atomics/T1566.001/T1566.001.md b/atomics/T1566.001/T1566.001.md index 1a51f1c0..64d17ac1 100644 --- a/atomics/T1566.001/T1566.001.md +++ b/atomics/T1566.001/T1566.001.md @@ -49,8 +49,8 @@ Remove-Item $env:TEMP\PhishingAttachment.xlsm -ErrorAction Ignore
## Atomic Test #2 - Word spawned a command shell and used an IP address in the command line -Word spawning a command prompt then running a command with an IP address in the command line is an indiciator of malicious activity. -Upon execution, CMD will be lauchned and ping 8.8.8.8 +Word spawning a command prompt then running a command with an IP address in the command line is an indicator of malicious activity. +Upon execution, CMD will be launched and ping 8.8.8.8. **Supported Platforms:** Windows