Update T1038 (#581)

Swaping on a /c for a /k so the test isnt blocking since this is spawning a new powershell session.
redcanaryco · Oct 8, 2019 · e1f2936 · e1f2936
1 parent af8e2d4
commit e1f2936
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/atomics/T1038/T1038.yaml b/atomics/T1038/T1038.yaml
@@ -18,4 +18,4 @@ atomic_tests:
     command: |
       copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\updater.exe
       copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll
-      cmd.exe /c %APPDATA%\updater.exe
+      cmd.exe /k %APPDATA%\updater.exe