diff --git a/atomics/T1074/Discovery.bat b/atomics/T1074/Discovery.bat index 8c51854a..46677d8d 100644 --- a/atomics/T1074/Discovery.bat +++ b/atomics/T1074/Discovery.bat @@ -8,7 +8,7 @@ net config workstation net accounts net accounts /domain net view -sc query +sc.exe query reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce