diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 5bf89142..2f45abe8 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -24153,7 +24153,7 @@ defense-evasion: Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027.004/src/calc.cs" -OutFile "#{input_file}" executor: command: 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:#{output_file} - #{input_file} + "#{input_file}" ' cleanup_command: 'del #{output_file} >nul 2>&1 diff --git a/atomics/Indexes/windows-index.yaml b/atomics/Indexes/windows-index.yaml index ca14d5db..fa99ba3d 100644 --- a/atomics/Indexes/windows-index.yaml +++ b/atomics/Indexes/windows-index.yaml @@ -20856,7 +20856,7 @@ defense-evasion: Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027.004/src/calc.cs" -OutFile "#{input_file}" executor: command: 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:#{output_file} - #{input_file} + "#{input_file}" ' cleanup_command: 'del #{output_file} >nul 2>&1 diff --git a/atomics/T1027.004/T1027.004.md b/atomics/T1027.004/T1027.004.md index 429f7201..3020899d 100644 --- a/atomics/T1027.004/T1027.004.md +++ b/atomics/T1027.004/T1027.004.md @@ -43,7 +43,7 @@ Upon execution an exe named T1027.004.exe will be placed in the temp folder ```cmd -C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:#{output_file} #{input_file} +C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:#{output_file} "#{input_file}" ``` #### Cleanup Commands: