From b2ccaa911bdf9a82e9fbe4a9f7a204db17a857f1 Mon Sep 17 00:00:00 2001 From: Jimmy Astle Date: Mon, 7 May 2018 15:43:40 -0400 Subject: [PATCH] minor syntax update Just updating the syntax on the $filtertoconsumerargs --- ...Windows_Management_Instrumentation_Event_Subscription.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Windows/Persistence/Windows_Management_Instrumentation_Event_Subscription.md b/Windows/Persistence/Windows_Management_Instrumentation_Event_Subscription.md index 98471a9e..291dd18f 100644 --- a/Windows/Persistence/Windows_Management_Instrumentation_Event_Subscription.md +++ b/Windows/Persistence/Windows_Management_Instrumentation_Event_Subscription.md @@ -22,8 +22,8 @@ $ConsumerArgs = @{name='AtomicRedTeam-WMIPersistence-Example'; $Consumer=New-CimInstance -Namespace root/subscription -ClassName CommandLineEventConsumer -Property $ConsumerArgs $FilterToConsumerArgs = @{ -Filter = [Ref] $Filter -Consumer = [Ref] $Consumer +Filter = [Ref] $Filter; +Consumer = [Ref] $Consumer; } $FilterToConsumerBinding = New-CimInstance -Namespace root/subscription -ClassName __FilterToConsumerBinding -Property $FilterToConsumerArgs ``` @@ -50,4 +50,4 @@ $EventFilterToCleanup | Remove-WmiObject #### References https://gist.github.com/mattifestation/7fe1df7ca2f08cbfa3d067def00c01af -https://github.com/EmpireProject/Empire/blob/master/data/module_source/persistence/Persistence.psm1#L545 \ No newline at end of file +https://github.com/EmpireProject/Empire/blob/master/data/module_source/persistence/Persistence.psm1#L545