Revert "MITRE ATT&CK realignment sprint"

yml/OSScripts/CL_LoadAssembly.yml

@@ -9,13 +9,14 @@ Commands:
     Usecase: Execute proxied payload with Microsoft signed binary
     Category: Execute
     Privileges: User
-    MitreID: T1216
+    MitreID: T1059.001
+    MitreLink: https://attack.mitre.org/techniques/T1059/001/
     OperatingSystem: Windows 10 21H1 (likely other versions as well)
 Full_Path:
   - Path: C:\Windows\diagnostics\system\Audio\CL_LoadAssembly.ps1
-Code_Sample:
+Code_Sample: 
   - Code:
-Detection:
+Detection: 
   - IOC:
 Resources:
   - Link: https://bohops.com/2018/01/07/executing-commands-and-bypassing-applocker-with-powershell-diagnostic-scripts/

yml/OSScripts/CL_mutexverifiers.yml

@@ -10,6 +10,7 @@ Commands:
     Category: Execute
     Privileges: User
     MitreID: T1216
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1216
     OperatingSystem: Windows 10
 Full_Path:
   - Path: C:\Windows\diagnostics\system\WindowsUpdate\CL_Mutexverifiers.ps1

yml/OSScripts/Cl_invocation.yml

@@ -10,6 +10,7 @@ Commands:
     Category: Execute
     Privileges: User
     MitreID: T1216
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1216
     OperatingSystem: Windows 10
 Full_Path:
   - Path: C:\Windows\diagnostics\system\AERO\CL_Invocation.ps1

yml/OSScripts/Manage-bde.yml

@@ -10,6 +10,7 @@ Commands:
     Category: Execute
     Privileges: User
     MitreID: T1216
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1216
     OperatingSystem: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
   - Command: copy c:\users\person\evil.exe c:\users\public\manage-bde.exe & cd c:\users\public\ & cscript.exe c:\windows\system32\manage-bde.wsf
     Description: Run the manage-bde.wsf script with a payload named manage-bde.exe in the same directory to run the payload file.
@@ -17,6 +18,7 @@ Commands:
     Category: Execute
     Privileges: User
     MitreID: T1216
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1216
     OperatingSystem: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
 Full_Path:
   - Path: C:\Windows\System32\manage-bde.wsf

yml/OSScripts/Pubprn.yml

@@ -9,7 +9,8 @@ Commands:
     Usecase: Proxy execution
     Category: Execute
     Privileges: User
-    MitreID: T1216.001
+    MitreID: T1216
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1216
     OperatingSystem: Windows 10
 Full_Path:
   - Path: C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs

yml/OSScripts/Syncappvpublishingserver.yml

@@ -10,6 +10,7 @@ Commands:
     Category: Execute
     Privileges: User
     MitreID: T1216
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1216
     OperatingSystem: Windows 10
 Full_Path:
   - Path: C:\Windows\System32\SyncAppvPublishingServer.vbs

yml/OSScripts/UtilityFunctions.yml

@@ -9,17 +9,18 @@ Commands:
     Usecase: Execute proxied payload with Microsoft signed binary
     Category: Execute
     Privileges: User
-    MitreID: T1216
+    MitreID: T1059.001
+    MitreLink: https://attack.mitre.org/techniques/T1059/001/
     OperatingSystem: Windows 10 21H1 (likely other versions as well)
 Full_Path:
   - Path: C:\Windows\diagnostics\system\Networking\UtilityFunctions.ps1
-Code_Sample:
+Code_Sample: 
   - Code:
-Detection:
+Detection: 
   - IOC:
 Resources:
   - Link: https://twitter.com/nickvangilder/status/1441003666274668546
 Acknowledgement:
   - Person: Nick VanGilder
     Handle: '@nickvangilder'
----
+---

yml/OSScripts/Winrm.yml

@@ -10,6 +10,7 @@ Commands:
     Category: Execute
     Privileges: User
     MitreID: T1216
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1216
     OperatingSystem: Windows 10
   - Command: 'winrm invoke Create wmicimv2/Win32_Service @{Name="Evil";DisplayName="Evil";PathName="cmd.exe /k c:\windows\system32\notepad.exe"} -r:http://acmedc:5985   \nwinrm invoke StartService wmicimv2/Win32_Service?Name=Evil -r:http://acmedc:5985'
     Description: Lateral movement/Remote Command Execution via WMI Win32_Service class over the WinRM protocol
@@ -17,6 +18,7 @@ Commands:
     Category: Execute
     Privileges: User
     MitreID: T1216
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1216
     OperatingSystem: Windows 10
   - Command: '%SystemDrive%\BypassDir\cscript //nologo %windir%\System32\winrm.vbs get wmicimv2/Win32_Process?Handle=4 -format:pretty'
     Description: Bypass AWL solutions by copying and executing cscript.exe and malicious XSL documents from attacker controlled location
@@ -24,6 +26,7 @@ Commands:
     Category: AWL Bypass
     Privileges: User
     MitreID: T1216
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1216
     OperatingSystem: Windows 10
 Full_Path:
   - Path: C:\Windows\System32\winrm.vbs

yml/OSScripts/pester.yml

@@ -10,6 +10,7 @@ Commands:
     Category: Execute
     Privileges: User
     MitreID: T1216
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1216
     OperatingSystem: Windows 10
 Full_Path:
   - Path: c:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat