From aae794c59c8b6d690a4bc76abe5cf95b6620e691 Mon Sep 17 00:00:00 2001 From: Kostas Date: Tue, 24 May 2022 14:23:18 -0700 Subject: [PATCH 1/2] Update Hh.yml Fixing the full path of the hh.exe binary to C:\Windows\hh.exe --- yml/OSBinaries/Hh.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/yml/OSBinaries/Hh.yml b/yml/OSBinaries/Hh.yml index fcaf79f..a48b970 100644 --- a/yml/OSBinaries/Hh.yml +++ b/yml/OSBinaries/Hh.yml @@ -19,8 +19,7 @@ Commands: MitreID: T1218.001 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 Full_Path: - - Path: C:\Windows\System32\hh.exe - - Path: C:\Windows\SysWOW64\hh.exe + - Path: C:\Windows\hh.exe Code_Sample: - Code: Detection: From 314f585da92ba459bd90385f9d266ae29606cf6e Mon Sep 17 00:00:00 2001 From: Kostas Date: Tue, 24 May 2022 15:29:03 -0700 Subject: [PATCH 2/2] Update Hh.yml Added SysWoW64 Path --- yml/OSBinaries/Hh.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/yml/OSBinaries/Hh.yml b/yml/OSBinaries/Hh.yml index a48b970..ad15db6 100644 --- a/yml/OSBinaries/Hh.yml +++ b/yml/OSBinaries/Hh.yml @@ -20,6 +20,7 @@ Commands: OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 Full_Path: - Path: C:\Windows\hh.exe + - Path: C:\Windows\SysWOW64\hh.exe Code_Sample: - Code: Detection: