From e73dea5813cab7a404765340617db08ac5f847fa Mon Sep 17 00:00:00 2001
From: Carrie Roberts <clr2of8@gmail.com>
Date: Thu, 12 Oct 2023 08:23:41 -0600
Subject: [PATCH] catch error and return exit code (#2566)

Co-authored-by: Michael Haag <5632822+MHaggis@users.noreply.github.com>
---
 atomics/T1018/T1018.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/atomics/T1018/T1018.yaml b/atomics/T1018/T1018.yaml
index 8ff1c9bc..89648059 100644
--- a/atomics/T1018/T1018.yaml
+++ b/atomics/T1018/T1018.yaml
@@ -364,7 +364,8 @@ atomic_tests:
     name: powershell
     elevation_required: false
     command: |
-      get-wmiobject -class ds_computer -namespace root\directory\ldap
+      try { get-wmiobject -class ds_computer -namespace root\directory\ldap -ErrorAction Stop }
+      catch { $_; exit $_.Exception.HResult }
 - name: Remote System Discovery - net group Domain Controller
   auto_generated_guid: 5843529a-5056-4bc1-9c13-a311e2af4ca0
   description: |