use external payloads directory (#2554)

Co-authored-by: Hare Sudhan <[email protected]>
redcanaryco · Oct 7, 2023 · 62f8397 · 62f8397
1 parent a08834a
commit 62f8397
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/atomics/T1027/T1027.yaml b/atomics/T1027/T1027.yaml
@@ -111,11 +111,10 @@ atomic_tests:
       Expand-Archive -path "PathToAtomicsFolder\..\ExternalPayloads\T1027.zip" -DestinationPath "PathToAtomicsFolder\..\ExternalPayloads\temp_T1027.zip\" -Force
   executor:
     command: |
-      "%temp%\temp_T1027.zip\T1027.exe"
+      "PathToAtomicsFolder\..\ExternalPayloads\temp_T1027.zip\T1027.exe"
     cleanup_command: |
       taskkill /f /im calculator.exe >nul 2>nul
-      rmdir /S /Q %temp%\temp_T1027.zip >nul 2>nul
-      del /Q "%temp%\T1027.zip" >nul 2>nul
+      taskkill /f /im CalculatorApp.exe >nul 2>nul
     name: command_prompt
 - name: DLP Evasion via Sensitive Data in VBA Macro over email
   auto_generated_guid: 129edb75-d7b8-42cd-a8ba-1f3db64ec4ad