Removing REM from T1112 - causing incorrect execution

[Jake151]

Details:
During an execution run I noticed that atomics were failing due to PowerShell scripts not being enabled on the host system. I traced the issue back to T1112:95b25212-91a7-42ff-9613-124aca6845a8 and specifically the REM command that is used in place of a comment. I don't know the specifics as to why this command stops execution but it results in the subsequent deletion command not being executed.

This screenshot shows execution of the atomic with the REM command in place, note the EnableScripts registry value remains

This screenshot shows execution of the same atomic with the REM command removed, note the removal of the registry value.

Testing:
Tested on W10

Associated Issues:
None

[clr2of8]

Thank you! The problem comes about because the execution frameworks combine all the commands into one line and comments don't know when to stop (essentially, everything after a comment becomes a comment)