diff --git a/atomics/T1037/T1037.md b/atomics/T1037/T1037.md index 697ea544..6e168502 100644 --- a/atomics/T1037/T1037.md +++ b/atomics/T1037/T1037.md @@ -33,11 +33,13 @@ Added Via Reg.exe #### Run it with `command_prompt`! ``` REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_MULTI_SZ /d "#{script_command}" -REM cleanup command below. -REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f ``` +#### Cleanup Commands: +``` +REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f +```

diff --git a/atomics/index.yaml b/atomics/index.yaml index 16105d06..fa2951fd 100644 --- a/atomics/index.yaml +++ b/atomics/index.yaml @@ -2675,10 +2675,14 @@ persistence: executor: name: command_prompt elevation_required: false - command: | - REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_MULTI_SZ /d "#{script_command}" - REM cleanup command below. - REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f + command: 'REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_MULTI_SZ + /d "#{script_command}" + +' + cleanup_command: 'REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript + /f + +' - name: Logon Scripts - Mac description: 'Mac logon script @@ -19699,10 +19703,14 @@ lateral-movement: executor: name: command_prompt elevation_required: false - command: | - REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_MULTI_SZ /d "#{script_command}" - REM cleanup command below. - REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f + command: 'REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_MULTI_SZ + /d "#{script_command}" + +' + cleanup_command: 'REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript + /f + +' - name: Logon Scripts - Mac description: 'Mac logon script