diff --git a/atomics/T1003/T1003.md b/atomics/T1003/T1003.md index 5fdbb4b4..6316d757 100644 --- a/atomics/T1003/T1003.md +++ b/atomics/T1003/T1003.md @@ -264,6 +264,7 @@ if (Test-Path #{wce_exe}) {exit 0} else {exit 1} ##### Get Prereq Commands: ``` $parentpath = Split-Path "#{wce_exe}"; $zippath = "$parentpath\wce.zip" +IEX(IWR "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-WebRequestVerifyHash.ps1") if(Invoke-WebRequestVerifyHash "#{wce_url}" "$zippath" #{wce_zip_hash}){ Expand-Archive $zippath $parentpath\wce -Force Move-Item $parentpath\wce\wce.exe "#{wce_exe}" diff --git a/atomics/index.yaml b/atomics/index.yaml index 5d433084..552e3d85 100644 --- a/atomics/index.yaml +++ b/atomics/index.yaml @@ -19539,6 +19539,7 @@ credential-access: prereq_command: 'if (Test-Path #{wce_exe}) {exit 0} else {exit 1}' get_prereq_command: |- $parentpath = Split-Path "#{wce_exe}"; $zippath = "$parentpath\wce.zip" + IEX(IWR "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-WebRequestVerifyHash.ps1") if(Invoke-WebRequestVerifyHash "#{wce_url}" "$zippath" #{wce_zip_hash}){ Expand-Archive $zippath $parentpath\wce -Force Move-Item $parentpath\wce\wce.exe "#{wce_exe}"