diff --git a/yml/OSBinaries/Regasm.yml b/yml/OSBinaries/Regasm.yml index 1569be0..1729e21 100644 --- a/yml/OSBinaries/Regasm.yml +++ b/yml/OSBinaries/Regasm.yml @@ -8,12 +8,12 @@ Commands: Description: Loads the target .DLL file and executes the RegisterClass function. Usecase: Execute code and bypass Application whitelisting Category: AWL bypass - Privileges: User + Privileges: Local Admin MitreID: T1121 MitreLink: https://attack.mitre.org/wiki/Technique/T1121 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 - - Command: regasm.exe AllTheThingsx64.dll - Description: Loads the target .DLL file and executes the RegisterClass function. + - Command: regasm.exe /U AllTheThingsx64.dll + Description: Loads the target .DLL file and executes the UnRegisterClass function. Usecase: Execute code and bypass Application whitelisting Category: Execute Privileges: User @@ -36,4 +36,4 @@ Resources: Acknowledgement: - Person: Casey Smith Handle: '@subtee' ---- \ No newline at end of file +---