diff --git a/atomics/T1027/T1027.yaml b/atomics/T1027/T1027.yaml index 26e65557..902043c2 100644 --- a/atomics/T1027/T1027.yaml +++ b/atomics/T1027/T1027.yaml @@ -81,7 +81,7 @@ atomic_tests: exe_payload: description: EXE to execute type: Path - default: '%temp%\temp_T1027.zip\T1027.exe' + default: '$env:temp\temp_T1027.zip\T1027.exe' url_path: description: url to download Exe type: url @@ -89,7 +89,7 @@ atomic_tests: dependency_executor_name: powershell dependencies: - description: | - T1027.exe must exist on disk at specified location + T1027.exe must exist on disk at #{exe_payload} prereq_command: | if (Test-Path #{exe_payload}) {exit 0} else {exit 1} get_prereq_command: |