This commit is contained in:
clr2of8
2020-12-19 16:26:33 -07:00
parent e059e698ba
commit fd2bbab66b
+1 -1
View File
@@ -147,7 +147,7 @@ atomic_tests:
Trickbot uses this TTP as follows:
rundll32.exe URL.dll,FileProtocolHandler C:\\..\\Detail\\akteullen.vbs
In this atomic, the sample hta file opens the calculator and the vbs file show a message dialog with "rundll32 spawned wscript"
In this atomic, the sample hta file opens the calculator and the vbs file shows a message dialog with "rundll32 spawned wscript"
supported_platforms:
- windows
executor: