From e0f262f32b386b3a0e0f2aa1dc91ae95957a8fbc Mon Sep 17 00:00:00 2001
From: Avihay Eldad <46644022+avihayeldad@users.noreply.github.com>
Date: Sun, 31 Aug 2025 18:22:52 +0300
Subject: [PATCH] Create WinDbg.yml (#450)

Co-authored-by: Wietze <wietze@users.noreply.github.com>
---
 yml/OtherMSBinaries/WinDbg.yml | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 yml/OtherMSBinaries/WinDbg.yml

diff --git a/yml/OtherMSBinaries/WinDbg.yml b/yml/OtherMSBinaries/WinDbg.yml
new file mode 100644
index 0000000..5ff2cfc
--- /dev/null
+++ b/yml/OtherMSBinaries/WinDbg.yml
@@ -0,0 +1,25 @@
+---
+Name: WinDbg.exe
+Description: Windows Debugger for advanced user-mode and kernel-mode debugging.
+Author: Avihay Eldad
+Created: 2025-07-16
+Commands:
+  - Command: windbg.exe -g {CMD}
+    Description: Launches a command line through the debugging process; optionally add `-G` to exit the debugger automatically.
+    Usecase: Executes an executable under a trusted microsoft signed binary.
+    Category: Execute
+    Privileges: User
+    MitreID: T1127
+    OperatingSystem: Windows
+    Tags:
+      - Execute: CMD
+Full_Path:
+  - Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\windbg.exe
+  - Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\windbg.exe
+  - Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\windbg.exe
+  - Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\windbg.exe
+Resources:
+  - Link: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/windbg-command-line-options
+Acknowledgement:
+  - Person: Avihay Eldad
+    Handle: '@AvihayEldad'