diff --git a/atomics/T1021.003/T1021.003.yaml b/atomics/T1021.003/T1021.003.yaml index 0da360b2..314c9d41 100644 --- a/atomics/T1021.003/T1021.003.yaml +++ b/atomics/T1021.003/T1021.003.yaml @@ -23,6 +23,7 @@ atomic_tests: [activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.application","#{computer_name}")).Document.ActiveView.ExecuteShellCommand("c:\windows\system32\calc.exe", $null, $null, "7") name: powershell - name: PowerShell Lateral Movement Using Excel Application Object + auto_generated_guid: b46d327c-c336-43d9-906e-d53be5358535 description: | Powershell lateral movement using the Excel COM objects. @@ -47,7 +48,7 @@ atomic_tests: cleanup_command: | Remove-Item 'C:\users\#{user}\AppData\local\Microsoft\WindowsApps\foxprow.exe' input_arguments: - computer_name: hostname + hostname: description: Hostname or IP type: string default: localhost