From b3ce1fb005e18c11e74ff1ee41a29505c8ccf075 Mon Sep 17 00:00:00 2001 From: Brian Thacker Date: Wed, 18 Dec 2019 10:32:36 -0600 Subject: [PATCH] T1074 .bat fix (#733) Changing "sc query" to "sc.exe query" so it runs with PowerShell. "sc" is an alias in powershell for Set-Content. --- atomics/T1074/Discovery.bat | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/atomics/T1074/Discovery.bat b/atomics/T1074/Discovery.bat index 8c51854a..46677d8d 100644 --- a/atomics/T1074/Discovery.bat +++ b/atomics/T1074/Discovery.bat @@ -8,7 +8,7 @@ net config workstation net accounts net accounts /domain net view -sc query +sc.exe query reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce