From 78fa7b550e1ec045c8ed2b4920f5c1d9a20cbc00 Mon Sep 17 00:00:00 2001
From: Avihay Eldad <46644022+avihayeldad@users.noreply.github.com>
Date: Thu, 23 May 2024 02:02:56 +0300
Subject: [PATCH] Add Winfile.yml (#374)

Co-authored-by: Wietze <wietze@users.noreply.github.com>
---
 yml/OtherMSBinaries/winfile.yml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 yml/OtherMSBinaries/winfile.yml

diff --git a/yml/OtherMSBinaries/winfile.yml b/yml/OtherMSBinaries/winfile.yml
new file mode 100644
index 0000000..f0171ed
--- /dev/null
+++ b/yml/OtherMSBinaries/winfile.yml
@@ -0,0 +1,24 @@
+---
+Name: winfile.exe
+Description: Windows File Manager executable
+Author: Avihay Eldad
+Created: 2024-04-30
+Commands:
+  - Command: winfile.exe calc.exe
+    Description: Execute an executable file with WinFile as a parent process.
+    Usecase: Performs execution of specified file, can be used as a defense evasion
+    Category: Execute
+    Privileges: User
+    MitreID: T1202
+    OperatingSystem: Windows 10, Windows 11
+Full_Path:
+  - Path: C:\Windows\System32\winfile.exe
+  - Path: C:\Windows\winfile.exe
+  - Path: C:\Program Files\WinFile\winfile.exe
+  - Path: C:\Program Files (x86)\WinFile\winfile.exe
+  - Path: C:\Program Files\WindowsApps\Microsoft.WindowsFileManager_10.3.0.0_x64__8wekyb3d8bbwe\WinFile\winfile.exe
+Resources:
+  - Link: https://github.com/microsoft/winfile
+Acknowledgement:
+  - Person: Avihay Eldad
+    Handle: '@AvihayEldad'