Generalising file paths and urls, see #10 (#422)

yml/OSBinaries/Extrac32.yml

@@ -1,10 +1,10 @@
 ---
 Name: Extrac32.exe
 Description: Extract to ADS, copy or overwrite a file with Extrac32.exe
-Author: 'Oddvar Moe'
+Author: Oddvar Moe
 Created: 2018-05-25
 Commands:
-  - Command: extrac32 C:\ADS\procexp.cab c:\ADS\file.txt:procexp.exe
+  - Command: extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe
     Description: Extracts the source CAB file into an Alternate Data Stream (ADS) of the target file.
     Usecase: Extract data from cab file and hide it in an alternate data stream.
     Category: ADS
@@ -13,7 +13,7 @@ Commands:
     OperatingSystem: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
     Tags:
       - Type: Compression
-  - Command: extrac32 \\webdavserver\webdav\file.cab c:\ADS\file.txt:file.exe
+  - Command: extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe
     Description: Extracts the source CAB file on an unc path into an Alternate Data Stream (ADS) of the target file.
     Usecase: Extract data from cab file and hide it in an alternate data stream.
     Category: ADS
@@ -22,15 +22,15 @@ Commands:
     OperatingSystem: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
     Tags:
       - Type: Compression
-  - Command: extrac32 /Y /C \\webdavserver\share\test.txt C:\folder\test.txt
+  - Command: extrac32 /Y /C {PATH_SMB} {PATH_ABSOLUTE}
     Description: Copy the source file to the destination file and overwrite it.
     Usecase: Download file from UNC/WEBDav
     Category: Download
     Privileges: User
     MitreID: T1105
     OperatingSystem: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
-  - Command: extrac32.exe /C C:\Windows\System32\calc.exe C:\Users\user\Desktop\calc.exe
-    Description: Command for copying calc.exe to another folder
+  - Command: extrac32.exe /C {PATH_ABSOLUTE:.source.exe} {PATH_ABSOLUTE:.dest.exe}
+    Description: Command for copying file from one folder to another
     Usecase: Copy file
     Category: Copy
     Privileges: User
@@ -39,8 +39,6 @@ Commands:
 Full_Path:
   - Path: C:\Windows\System32\extrac32.exe
   - Path: C:\Windows\SysWOW64\extrac32.exe
-Code_Sample:
-  - Code:
 Detection:
   - Elastic: https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml
   - Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32.yml