diff --git a/atomics/T1071/T1071.md b/atomics/T1071/T1071.md index e1ad7a26..876ef8e3 100644 --- a/atomics/T1071/T1071.md +++ b/atomics/T1071/T1071.md @@ -86,7 +86,7 @@ The intent of this test is to trigger threshold based detection on the number of #### Run it with `powershell`! ``` -for($i=0; $i -le $#{query_volume}; $i++) { Resolve-DnsName -type "#{query_type}" "#{subdomain}.$(Get-Random -Minimum 1 -Maximum 999999).#{domain}" -QuickTimeout} +for($i=0; $i -le #{query_volume}; $i++) { Resolve-DnsName -type "#{query_type}" "#{subdomain}.$(Get-Random -Minimum 1 -Maximum 999999).#{domain}" -QuickTimeout} ``` diff --git a/atomics/index.yaml b/atomics/index.yaml index d0cd1279..e9e58c53 100644 --- a/atomics/index.yaml +++ b/atomics/index.yaml @@ -22316,7 +22316,7 @@ command-and-control: executor: name: powershell elevation_required: false - command: 'for($i=0; $i -le $#{query_volume}; $i++) { Resolve-DnsName -type + command: 'for($i=0; $i -le #{query_volume}; $i++) { Resolve-DnsName -type "#{query_type}" "#{subdomain}.$(Get-Random -Minimum 1 -Maximum 999999).#{domain}" -QuickTimeout}