diff --git a/atomics/T1040/T1040.yaml b/atomics/T1040/T1040.yaml index 461d8876ce..1e18cdacbc 100644 --- a/atomics/T1040/T1040.yaml +++ b/atomics/T1040/T1040.yaml @@ -451,9 +451,9 @@ atomic_tests: command: | New-NetEventSession -Name Capture007 -LocalFilePath "$ENV:Temp\sniff.etl" Add-NetEventPacketCaptureProvider -SessionName Capture007 -TruncationLength 100 - Start-NetEventSession -Name Capture007 - Stop-NetEventSession -Name Capture007 - Remove-NetEventSession -Name Capture007 + Start-NetEventSession -Name Capture007 + Stop-NetEventSession -Name Capture007 + Remove-NetEventSession -Name Capture007 cleanup_command: |- del $ENV:Temp\sniff.etl name: command_prompt