Discovery.bat: add missing quote around path containing a space chara…

…cter (#1029) Co-authored-by: Carrie Roberts <[email protected]>
redcanaryco · Jun 20, 2020 · e4bde98 · e4bde98
1 parent 52daaea
commit e4bde98
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/atomics/T1074.001/src/Discovery.bat b/atomics/T1074.001/src/Discovery.bat
@@ -14,10 +14,10 @@ reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
 reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
 reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
 reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
-reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
-reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
-reg query HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell
-reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell
+reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify"
+reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit"
+reg query "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell"
+reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell"
 reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
 reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
 reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx