diff --git a/atomics/T1193/T1193.yaml b/atomics/T1193/T1193.yaml
index 7646a522..9401b3aa 100644
--- a/atomics/T1193/T1193.yaml
+++ b/atomics/T1193/T1193.yaml
@@ -25,13 +25,3 @@ atomic_tests:
         [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
         ($wc.DownloadString("$url")) | Out-File $fileName
       }
-
-- name: Word spawned a command shell and used an IP address in the command line
-  description: |
-    Opens a word document that will run powershell and perform an nslookup on the IP 192.168.1.1 and a sleep command
-  supported_platforms:
-    - windows
-  executor:
-    name: powershell
-    command: |
-      Start-Process $PathToAtomicsFolder\T1193\bin\PowerShell_IP_Doc.doc
diff --git a/atomics/T1193/bin/PowerShell_IP_Doc.doc b/atomics/T1193/bin/PowerShell_IP_Doc.doc
deleted file mode 100644
index c8695e40..00000000
Binary files a/atomics/T1193/bin/PowerShell_IP_Doc.doc and /dev/null differ