T1055-2 passed prereqs, failed test.

[dsq717]

What did you do?

Installed ART via Invoke-AtomicRedTeam using all default settings and default folder locations
Ran all tests within T1055 set using default parameters
All tests passed except for T1055-2
Attempted to troubleshoot through T1055 YAML file; no indication of syntax errors.
Verified all PreReq .exe files (PsExec.exe and mimikatz.exe) were in their expected folder locations

What did you expect to happen?

The test to run without failing

What happened instead?

The filename, directory name, or volume label syntax is incorrect.
Exit code: 1

Your Environment

Windows 11 Home 23H2 running in VirtualBox
Ran as Administrator
Using Invoke-AtomicTest

[chrisanag1985]

I faced the same issue ... The problem is the quotes of the first command "PsExec". If you remove the quotes it works just fine.

in the file https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1055/T1055.yaml (on your local directory)

"#{psexec_path}" /accepteula \#{machine} -c #{mimikatz_path} "lsadump::lsa /inject /id:500" "exit"

to:

#{psexec_path} /accepteula \#{machine} -c #{mimikatz_path} "lsadump::lsa /inject /id:500" "exit"