From cc1aced76b0944a02467ba08ba27a8b7fe181e36 Mon Sep 17 00:00:00 2001 From: axi0m Date: Wed, 22 Apr 2020 11:25:25 -0500 Subject: [PATCH] Minor fix for T1115 - Pipe Get-Clipboard output (#952) * Update T1115.yaml Update command for PowerShell so the contents of Get-Clipboard are actually invoked as an expression. * Update Markdown PowerShell code snippet to reflect changes * Pipe output of Get-Clipboard to iex in order to invoke the value of clipboard as a command Co-authored-by: Carrie Roberts --- atomics/T1115/T1115.md | 2 +- atomics/T1115/T1115.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/atomics/T1115/T1115.md b/atomics/T1115/T1115.md index 50450cd3..78250a2e 100644 --- a/atomics/T1115/T1115.md +++ b/atomics/T1115/T1115.md @@ -63,7 +63,7 @@ Utilize PowerShell to echo a command to clipboard and execute it ```powershell echo Get-Process | clip -iex Get-Clipboard +Get-Clipboard | iex ``` diff --git a/atomics/T1115/T1115.yaml b/atomics/T1115/T1115.yaml index 22e59ce0..e1da4bff 100644 --- a/atomics/T1115/T1115.yaml +++ b/atomics/T1115/T1115.yaml @@ -29,4 +29,4 @@ atomic_tests: elevation_required: false command: | echo Get-Process | clip - iex Get-Clipboard + Get-Clipboard | iex