More changes (mainly changing generic T1218 to dev-specific T1127)

yml/OSBinaries/Aspnet_Compiler.yml

@@ -9,7 +9,7 @@ Commands:
     Usecase: Execute proxied payload with Microsoft signed binary to bypass application control solutions
     Category: AWL Bypass
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows 10
 Full_Path:
   - Path: c:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

yml/OSBinaries/FltMC.yml

@@ -9,7 +9,7 @@ Commands:
     Usecase: Defense evasion
     Category: ADS
     Privileges: Admin
-    MitreID: T1562
+    MitreID: T1562.001
     OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full_Path:
   - Path: C:\Windows\System32\fltMC.exe

yml/OSBinaries/Msbuild.yml

@@ -9,37 +9,35 @@ Commands:
     Usecase: Compile and run code
     Category: AWL bypass
     Privileges: User
-    MitreID: T1127
+    MitreID: T1127.001
     OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: msbuild.exe project.csproj
     Description: Build and execute a C# project stored in the target csproj file.
     Usecase: Compile and run code
     Category: Execute
     Privileges: User
-    MitreID: T1127
+    MitreID: T1127.001
     OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: msbuild.exe @sample.rsp
-    Description: Executes Logger statements from rsp file 
+    Description: Executes Logger statements from rsp file
     Usecase: Execute DLL
     Category: Execute
     Privileges: User
-    MitreID: T1127
-    MitreLink: https://attack.mitre.org/wiki/Technique/T1127
+    MitreID: T1127.001
     OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: msbuild.exe /logger:TargetLogger,C:\Loggers\TargetLogger.dll;MyParameters,Foo
     Description: Executes generated Logger dll file with TargetLogger export
     Usecase: Execute DLL
     Category: Execute
     Privileges: User
-    MitreID: T1127
-    MitreLink: https://attack.mitre.org/wiki/Technique/T1127
+    MitreID: T1127.001
     OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: msbuild.exe project.proj
     Description: Execute jscript/vbscript code through XML/XSL Transformation. Requires Visual Studio MSBuild v14.0+.
     Usecase: Execute project file that contains XslTransformation tag parameters
     Category: Execute
     Privileges: User
-    MitreID: T1127
+    MitreID: T1127.001
     OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full_Path:
   - Path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\Msbuild.exe

yml/OSBinaries/Ttdinject.yml

@@ -9,14 +9,14 @@ Commands:
     Usecase: Spawn process using other binary
     Category: Execute
     Privileges: Administrator
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows 10 2004
   - Command: ttdinject.exe /ClientScenario TTDRecorder /ddload 0 /ClientParams "7 tmp.run 0 0 0 0 0 0 0 0 0 0" /launch "C:/Windows/System32/calc.exe"
     Description: Execute calc using ttdinject.exe. Requires administrator privileges. A log file will be created in tmp.run. The log file can be changed, but the length (7) has to be updated.
     Usecase: Spawn process using other binary
     Category: Execute
     Privileges: Administrator
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows 10 1909
 Full_Path:
   - Path: C:\Windows\System32\ttdinject.exe

yml/OSBinaries/Tttracer.yml

@@ -9,7 +9,7 @@ Commands:
     Usecase: Spawn process using other binary
     Category: Execute
     Privileges: Administrator
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows 10 1809 and newer
   - Command: TTTracer.exe -dumpFull -attach pid
     Description: Dumps process using tttracer.exe. Requires administrator privileges