From 6128b4ea62f796c286e7dd24a8613cf86307a589 Mon Sep 17 00:00:00 2001
From: bohops <jimmy@jbtech.us>
Date: Mon, 24 Sep 2018 14:02:23 -0400
Subject: [PATCH] Update Pcwutl.yml

---
 yml/OSLibraries/Pcwutl.yml | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/yml/OSLibraries/Pcwutl.yml b/yml/OSLibraries/Pcwutl.yml
index 2577154..ac12eb0 100644
--- a/yml/OSLibraries/Pcwutl.yml
+++ b/yml/OSLibraries/Pcwutl.yml
@@ -6,21 +6,22 @@ Created: '2018-05-25'
 Commands:
   - Command: rundll32.exe pcwutl.dll,LaunchApplication calc.exe
     Description: Launch executable by calling the LaunchApplication function.
-    Usecase: Launch an executable.
+    UseCase: Launch an executable.
     Category: Execution
     Privileges: User
     MitreID: T1085
     MItreLink: https://attack.mitre.org/wiki/Technique/T1085
     OperatingSystem: Windows
 Full Path:
-  - path: c:\windows\system32\pcwutl.dll
-  - path: c:\windows\syswow64\pcwutl.dll
+  - Path: c:\windows\system32\pcwutl.dll
+  - Path: c:\windows\syswow64\pcwutl.dll
 Code Sample:
-  - ''
-Detection: []
+  - Code: ''
+Detection:
+  - IOC:
 Resources:
-  - resource: https://twitter.com/harr0ey/status/989617817849876488
-  - resource: https://windows10dll.nirsoft.net/pcwutl_dll.html
+  - Link: https://twitter.com/harr0ey/status/989617817849876488
+  - Link: https://windows10dll.nirsoft.net/pcwutl_dll.html
 Acknowledgment:
   - Person: Matt harr0ey
-    Handle: '@harr0ey'
\ No newline at end of file
+    Handle: '@harr0ey'