From e4bde98f94d8fd4b490c1b2b2dbd8ab350fce1b7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cl=C3=A9ment=20Notin?= Date: Sat, 20 Jun 2020 03:03:30 +0200 Subject: [PATCH] Discovery.bat: add missing quote around path containing a space character (#1029) Co-authored-by: Carrie Roberts --- atomics/T1074.001/src/Discovery.bat | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/atomics/T1074.001/src/Discovery.bat b/atomics/T1074.001/src/Discovery.bat index 46677d8d..0efc01d2 100644 --- a/atomics/T1074.001/src/Discovery.bat +++ b/atomics/T1074.001/src/Discovery.bat @@ -14,10 +14,10 @@ reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices -reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify -reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit -reg query HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell +reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" +reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit" +reg query "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell" +reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell" reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx