diff --git a/yml/OSBinaries/Eventvwr.yml b/yml/OSBinaries/Eventvwr.yml index ead74be..e19150e 100644 --- a/yml/OSBinaries/Eventvwr.yml +++ b/yml/OSBinaries/Eventvwr.yml @@ -15,7 +15,7 @@ Commands: Full_Path: - Path: C:\Windows\System32\eventvwr.exe - Path: C:\Windows\SysWOW64\eventvwr.exe -Code Sample: +Code_Sample: - Code: https://github.com/enigma0x3/Misc-PowerShell-Stuff/blob/master/Invoke-EventVwrBypass.ps1 Detection: - IOC: eventvwr.exe launching child process other than mmc.exe diff --git a/yml/OSBinaries/Wsreset.yml b/yml/OSBinaries/Wsreset.yml index 84edaf6..9c00099 100644 --- a/yml/OSBinaries/Wsreset.yml +++ b/yml/OSBinaries/Wsreset.yml @@ -14,7 +14,7 @@ Commands: OperatingSystem: Windows 10 Full_Path: - Path: C:\Windows\System32\wsreset.exe -Code Sample: +Code_Sample: - Code: Detection: - IOC: wsreset.exe launching child process other than mmc.exe