diff --git a/yml/OSLibraries/Shell32.yml b/yml/OSLibraries/Shell32.yml index 0afce49..302ded6 100644 --- a/yml/OSLibraries/Shell32.yml +++ b/yml/OSLibraries/Shell32.yml @@ -17,12 +17,14 @@ Commands: Category: Execute Privileges: User MitreID: T1218.011 + OperatingSystem: Windows - Command: rundll32 SHELL32.DLL,ShellExec_RunDLL "cmd.exe" "/c echo hi" Description: Launch command line by calling the ShellExec_RunDLL function. Usecase: Run an executable payload. Category: Execute Privileges: User MitreID: T1218.011 + OperatingSystem: Windows Full_Path: - Path: c:\windows\system32\shell32.dll - Path: c:\windows\syswow64\shell32.dll