diff --git a/atomics/T1136.002/T1136.002.yaml b/atomics/T1136.002/T1136.002.yaml index 4bdc79bb..c8a4875e 100644 --- a/atomics/T1136.002/T1136.002.yaml +++ b/atomics/T1136.002/T1136.002.yaml @@ -81,6 +81,6 @@ atomic_tests: $User.Save() $User cleanup_command: | - net user "#{username}" >nul 2>&1 /del /domain + cmd /c "net user #{username} /del >nul 2>&1" name: powershell elevation_required: false # Requires a user to be a Domain Admin!