From 7ac896f82a922986285bb3ba3c9ddfa0dc0f95cf Mon Sep 17 00:00:00 2001
From: Ryan <2059326+awsmhacks@users.noreply.github.com>
Date: Thu, 8 Apr 2021 07:22:23 -0600
Subject: [PATCH] Update T1027.yaml (#1418)

Because, powershell executor

Co-authored-by: Michael Haag <5632822+MHaggis@users.noreply.github.com>
---
 atomics/T1027/T1027.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/atomics/T1027/T1027.yaml b/atomics/T1027/T1027.yaml
index 26e65557..902043c2 100644
--- a/atomics/T1027/T1027.yaml
+++ b/atomics/T1027/T1027.yaml
@@ -81,7 +81,7 @@ atomic_tests:
     exe_payload:
       description: EXE to execute
       type: Path
-      default: '%temp%\temp_T1027.zip\T1027.exe'
+      default: '$env:temp\temp_T1027.zip\T1027.exe'
     url_path:
       description: url to download Exe
       type: url
@@ -89,7 +89,7 @@ atomic_tests:
   dependency_executor_name: powershell
   dependencies:
   - description: |
-      T1027.exe must exist on disk at specified location
+      T1027.exe must exist on disk at #{exe_payload}
     prereq_command: |
       if (Test-Path #{exe_payload}) {exit 0} else {exit 1}
     get_prereq_command: |