From 79e706f2dfcb95a381de87cdec76415cfd9403cd Mon Sep 17 00:00:00 2001
From: Carrie Roberts <clr2of8@gmail.com>
Date: Fri, 9 Jul 2021 09:34:32 -0600
Subject: [PATCH] fix cleanup cmd as per issue #1543 (#1548)

---
 atomics/T1136.002/T1136.002.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/atomics/T1136.002/T1136.002.yaml b/atomics/T1136.002/T1136.002.yaml
index 4bdc79bb..c8a4875e 100644
--- a/atomics/T1136.002/T1136.002.yaml
+++ b/atomics/T1136.002/T1136.002.yaml
@@ -81,6 +81,6 @@ atomic_tests:
       $User.Save()
       $User
     cleanup_command: |
-      net user "#{username}" >nul 2>&1 /del /domain
+      cmd /c "net user #{username} /del >nul 2>&1"
     name: powershell
     elevation_required: false  # Requires a user to be a Domain Admin!