From a61d2586cf6d5b61c118fb8c8f1e96010baba3c6 Mon Sep 17 00:00:00 2001
From: Oddvar Moe <oddvar.moe@gmail.com>
Date: Thu, 25 Oct 2018 21:24:55 +0200
Subject: [PATCH] Errors in YAML files corrected

---
 .../Microsoft.Workflow.Compiler.yml           | 40 ++++++++-----------
 yml/OSBinaries/Schtasks.yml                   | 23 ++++++-----
 yml/OSScripts/Winrm.yml                       |  2 +-
 3 files changed, 31 insertions(+), 34 deletions(-)

diff --git a/yml/OSBinaries/Microsoft.Workflow.Compiler.yml b/yml/OSBinaries/Microsoft.Workflow.Compiler.yml
index 1a7d35b..eec5b16 100644
--- a/yml/OSBinaries/Microsoft.Workflow.Compiler.yml
+++ b/yml/OSBinaries/Microsoft.Workflow.Compiler.yml
@@ -11,19 +11,11 @@ Commands:
     Privileges: User
     MitreID: T1127
     MitreLink: https://attack.mitre.org/wiki/Technique/T1127
-    OperatingSystem: Windows 10S 
+    OperatingSystem: Windows 10S
   - Command: Microsoft.Worflow.Compiler.exe tests.txt results.txt
     Description: Compile and execute C# or VB.net code in a XOML file referenced in the test.txt file.
     Usecase: Compile and run code
-    Category: Execution
-    Privileges: User
-    MitreID: T1127
-    MitreLink: https://attack.mitre.org/wiki/Technique/T1127
-    OperatingSystem: Windows 10S 
-  - Command: Microsoft.Worflow.Compiler.exe tests.xml results.xml
-    Description: Compile and execute C# or VB.net code in a XOML file referenced in the test.xml file.
-    Usecase: Compile and run code
-    Category: AWL Bypass
+    Category: Execute
     Privileges: User
     MitreID: T1127
     MitreLink: https://attack.mitre.org/wiki/Technique/T1127
@@ -37,22 +29,22 @@ Commands:
     MitreLink: https://attack.mitre.org/wiki/Technique/T1127
     OperatingSystem: Windows 10S 
 Full Path:
-- Path: C:\Windows\Microsoft.Net\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
+  - Path: C:\Windows\Microsoft.Net\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
 Code Sample: 
 - Code:
-Detection: 
-- IOC: Microsoft.Workflow.Compiler.exe would not normally be run on workstations.
-- IOC: The presence of csc.exe or vbc.exe as child processes of Microsoft.Workflow.Compiler.exe
-- IOC: Presence of "<CompilerInput" in a text file.
+Detection:
+ - IOC: Microsoft.Workflow.Compiler.exe would not normally be run on workstations.
+ - IOC: The presence of csc.exe or vbc.exe as child processes of Microsoft.Workflow.Compiler.exe
+ - IOC: Presence of "<CompilerInput" in a text file.
 Resources:
- - Link: https://twitter.com/mattifestation/status/1030445200475185154
- - Link: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
- - Link: https://gist.github.com/mattifestation/3e28d391adbd7fe3e0c722a107a25aba#file-workflowcompilerdetectiontests-ps1
- - Link: https://gist.github.com/mattifestation/7ba8fc8f724600a9f525714c9cf767fd#file-createcompilerinputxml-ps1
- - Link: https://www.forcepoint.com/blog/security-labs/using-c-post-powershell-attacks
- - Link: https://www.fortynorthsecurity.com/microsoft-workflow-compiler-exe-veil-and-cobalt-strike/
- - Link: https://medium.com/@Bank_Security/undetectable-c-c-reverse-shells-fab4c0ec4f15
- Acknowledgement:
+  - Link: https://twitter.com/mattifestation/status/1030445200475185154
+  - Link: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
+  - Link: https://gist.github.com/mattifestation/3e28d391adbd7fe3e0c722a107a25aba#file-workflowcompilerdetectiontests-ps1
+  - Link: https://gist.github.com/mattifestation/7ba8fc8f724600a9f525714c9cf767fd#file-createcompilerinputxml-ps1
+  - Link: https://www.forcepoint.com/blog/security-labs/using-c-post-powershell-attacks
+  - Link: https://www.fortynorthsecurity.com/microsoft-workflow-compiler-exe-veil-and-cobalt-strike/
+  - Link: https://medium.com/@Bank_Security/undetectable-c-c-reverse-shells-fab4c0ec4f15
+Acknowledgement:
   - Person: Matt Graeber
     Handle: '@mattifestation'
   - Person: John Bergbom
@@ -61,4 +53,4 @@ Resources:
     Handle: '@FortyNorthSec'
   - Person: Bank Security
     Handle: '@Bank_Security'
----
+---
\ No newline at end of file
diff --git a/yml/OSBinaries/Schtasks.yml b/yml/OSBinaries/Schtasks.yml
index 7b3deff..9016ef8 100644
--- a/yml/OSBinaries/Schtasks.yml
+++ b/yml/OSBinaries/Schtasks.yml
@@ -1,22 +1,27 @@
 ---
 Name: Schtasks.exe
 Description: Schedule periodic tasks
-Author: 'Ossi Vaananen'
-Created: '2018-10-24'
+Author: 'Oddvar Moe'
+Created: '2018-05-25'
 Commands:
   - Command: schtasks /create /sc minute /mo 1 /tn "Reverse shell" /tr c:\some\directory\revshell.exe
     Description: Create a recurring task to execute every minute.
     Usecase: Create a recurring task, to eg. to keep reverse shell session(s) alive
-    Category: Persistence
+    Category: Persistence 
     Privileges: User
+    MitreID: T1053
+    MitreLink: https://attack.mitre.org/wiki/Technique/T1053
     OperatingSystem: Windows
 Full Path:
-- Path: c:\windows\system32\schtasks.exe
+  - Path: c:\windows\system32\schtasks.exe
+  - Path: c:\windows\syswow64\schtasks.exe
 Code Sample: 
-- Code:
+  - Code:
+Detection:
+  - IOC: Services that gets created
 Resources:
- - Link: https://isc.sans.edu/forums/diary/Adding+Persistence+Via+Scheduled+Tasks/23633/
- Acknowledgement:
-  - Person: Ossi Vaananen
+  - Link: https://isc.sans.edu/forums/diary/Adding+Persistence+Via+Scheduled+Tasks/23633/
+Acknowledgement:
+  - Person:
     Handle:
----
+---
\ No newline at end of file
diff --git a/yml/OSScripts/Winrm.yml b/yml/OSScripts/Winrm.yml
index 1b6a034..1e19cd2 100644
--- a/yml/OSScripts/Winrm.yml
+++ b/yml/OSScripts/Winrm.yml
@@ -28,7 +28,7 @@ Commands:
     MitreID: T1216
     MitreLink: https://attack.mitre.org/wiki/Technique/T1216
     OperatingSystem: Windows 10
- - Command: '%SystemDrive%\BypassDir\cscript //nologo %windir%\System32\winrm.vbs get wmicimv2/Win32_Process?Handle=4 -format:pretty'
+  - Command: '%SystemDrive%\BypassDir\cscript //nologo %windir%\System32\winrm.vbs get wmicimv2/Win32_Process?Handle=4 -format:pretty'
     Description: Bypass AWL solutions by copying and executing cscript.exe and malicious XSL documents from attacker controlled location
     Usecase: Execute aribtrary, unsigned code via XSL script
     Category: AWL Bypass