From 2c9043a8fe2bd9296bdcf7eb7c75cc970326c393 Mon Sep 17 00:00:00 2001
From: bohops <jimmy@jbtech.us>
Date: Mon, 24 Sep 2018 14:26:49 -0400
Subject: [PATCH] Update Shell32.yml

---
 yml/OSLibraries/Shell32.yml | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/yml/OSLibraries/Shell32.yml b/yml/OSLibraries/Shell32.yml
index ee4c858..345d3fa 100644
--- a/yml/OSLibraries/Shell32.yml
+++ b/yml/OSLibraries/Shell32.yml
@@ -6,7 +6,7 @@ Created: '2018-05-25'
 Commands:
   - Command: rundll32.exe shell32.dll,Control_RunDLL payload.dll
     Description: Launch a DLL payload by calling the Control_RunDLL function.
-    Usecase: Load a DLL payload.
+    UseCase: Load a DLL payload.
     Category: Execution
     Privileges: User
     MitreID: T1085
@@ -14,29 +14,31 @@ Commands:
     OperatingSystem: Windows
   - Command: rundll32.exe shell32.dll,ShellExec_RunDLL beacon.exe
     Description: Launch an executable by calling the ShellExec_RunDLL function.
-    Usecase: Run an executable payload.
+    UseCase: Run an executable payload.
     Category: Execution
     Privileges: User
     MitreID: T1085
     MItreLink: https://attack.mitre.org/wiki/Technique/T1085
   - Command: rundll32 SHELL32.DLL,ShellExec_RunDLL "cmd.exe" "/c echo hi"
     Description: Launch command line by calling the ShellExec_RunDLL function.
-    Usecase: Run an executable payload.
+    UseCase: Run an executable payload.
     Category: Execution
     Privileges: User
     MitreID: T1085
     MItreLink: https://attack.mitre.org/wiki/Technique/T1085
 Full Path:
-  - path: c:\windows\system32\shell32.dll
-  - path: c:\windows\syswow64\shell32.dll
-Code Sample: []
-Detection: []
+  - Path: c:\windows\system32\shell32.dll
+  - Path: c:\windows\syswow64\shell32.dll
+Code Sample:
+  - Code: ''
+Detection:
+  - IOC: ''
 Resources:
-  - resource: https://twitter.com/Hexacorn/status/885258886428725250
-  - resource: https://twitter.com/pabraeken/status/991768766898941953
-  - resource: https://twitter.com/mattifestation/status/776574940128485376
-  - resource: https://twitter.com/KyleHanslovan/status/905189665120149506
-  - resource: https://windows10dll.nirsoft.net/shell32_dll.html
+  - Link: https://twitter.com/Hexacorn/status/885258886428725250
+  - Link: https://twitter.com/pabraeken/status/991768766898941953
+  - Link: https://twitter.com/mattifestation/status/776574940128485376
+  - Link: https://twitter.com/KyleHanslovan/status/905189665120149506
+  - Link: https://windows10dll.nirsoft.net/shell32_dll.html
 Acknowledgment:
   - Person: Adam (Control_RunDLL)
     Handle: '@hexacorn'
@@ -45,4 +47,4 @@ Acknowledgment:
   - Person: Matt Graeber (ShellExec_RunDLL)
     Handle: '@mattifestation'
   - Person: Kyle Hanslovan (ShellExec_RunDLL)
-    Handle: '@KyleHanslovan'
\ No newline at end of file
+    Handle: '@KyleHanslovan'