diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 9b40b4c9..fa082ddf 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -41322,6 +41322,7 @@ privilege-escalation: description: Path to DLL type: Path default: PathToAtomicsFolder\T1546.007\bin\NetshHelper.dll + dependency_executor_name: powershell dependencies: - description: 'Helper DLL must exist on disk at specified location (#{helper_file}) @@ -64425,6 +64426,7 @@ persistence: description: Path to DLL type: Path default: PathToAtomicsFolder\T1546.007\bin\NetshHelper.dll + dependency_executor_name: powershell dependencies: - description: 'Helper DLL must exist on disk at specified location (#{helper_file}) diff --git a/atomics/T1546.007/T1546.007.md b/atomics/T1546.007/T1546.007.md index d0166eb7..ba7b208e 100644 --- a/atomics/T1546.007/T1546.007.md +++ b/atomics/T1546.007/T1546.007.md @@ -48,14 +48,14 @@ netsh.exe delete helper #{helper_file} -#### Dependencies: Run with `command_prompt`! +#### Dependencies: Run with `powershell`! ##### Description: Helper DLL must exist on disk at specified location (#{helper_file}) ##### Check Prereq Commands: -```cmd +```powershell if (Test-Path "#{helper_file}") { exit 0} else { exit 1} ``` ##### Get Prereq Commands: -```cmd +```powershell New-Item -Type Directory (split-path #{helper_file}) -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.007/bin/NetshHelper.dll" -OutFile "#{helper_file}" ```