From fd2bbab66b7e101dac102f58f91d4d2be005d13b Mon Sep 17 00:00:00 2001 From: clr2of8 Date: Sat, 19 Dec 2020 16:26:33 -0700 Subject: [PATCH] typo fix --- atomics/T1218.011/T1218.011.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/atomics/T1218.011/T1218.011.yaml b/atomics/T1218.011/T1218.011.yaml index 1b8412ac..2b917385 100644 --- a/atomics/T1218.011/T1218.011.yaml +++ b/atomics/T1218.011/T1218.011.yaml @@ -147,7 +147,7 @@ atomic_tests: Trickbot uses this TTP as follows: rundll32.exe URL.dll,FileProtocolHandler C:\\..\\Detail\\akteullen.vbs - In this atomic, the sample hta file opens the calculator and the vbs file show a message dialog with "rundll32 spawned wscript" + In this atomic, the sample hta file opens the calculator and the vbs file shows a message dialog with "rundll32 spawned wscript" supported_platforms: - windows executor: