From 94a295213e40ae39046b3164dbbc497d203fea3c Mon Sep 17 00:00:00 2001
From: Oddvar Moe <oddvar.moe@gmail.com>
Date: Mon, 18 Nov 2019 12:50:49 +0100
Subject: [PATCH] Added Dump example to TTTracer.exe

---
 yml/OSBinaries/Tttracer.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/yml/OSBinaries/Tttracer.yml b/yml/OSBinaries/Tttracer.yml
index 659410b..e7e6a1d 100644
--- a/yml/OSBinaries/Tttracer.yml
+++ b/yml/OSBinaries/Tttracer.yml
@@ -12,7 +12,7 @@ Commands:
     MitreID: T1218
     MitreLink: https://attack.mitre.org/wiki/Technique/T1218
     OperatingSystem: Windows 10 1809 and newer
-  - Command: TTTracer.exe -dumpFull -attach <lsass_pid>
+  - Command: TTTracer.exe -dumpFull -attach pid
     Description: Dumps process using tttracer.exe. Requires administrator privileges
     Usecase: Dump process by PID
     Category: Dump