diff --git a/atomics/T1193/T1193.yaml b/atomics/T1193/T1193.yaml index 172a5753..7646a522 100644 --- a/atomics/T1193/T1193.yaml +++ b/atomics/T1193/T1193.yaml @@ -29,11 +29,9 @@ atomic_tests: - name: Word spawned a command shell and used an IP address in the command line description: | Opens a word document that will run powershell and perform an nslookup on the IP 192.168.1.1 and a sleep command - supported_platforms: - windows - executor: name: powershell command: | - Start-Process PathToAtomicsFolder\T1193\src\PowerShell_IP_Doc.doc + Start-Process $PathToAtomicsFolder\T1193\bin\PowerShell_IP_Doc.doc