Merge remote-tracking branch 'upstream/master' into windows_11_sprint

yml/OSScripts/CL_LoadAssembly.yml

@@ -1,29 +1,3 @@
-<<<<<<< HEAD
----
-Name: CL_LoadAssembly.ps1
-Description: PowerShell Diagnostic Script
-Author: Jimmy (@bohops)
-Created: 2021-09-26
-Commands:
-  - Command: 'powershell.exe -ep bypass -command "set-location -path C:\Windows\diagnostics\system\Audio; import-module .\CL_LoadAssembly.ps1; LoadAssemblyFromPath ..\..\..\..\testing\fun.dll;[Program]::Fun()"'
-    Description: Proxy execute Managed DLL with PowerShell
-    Usecase: Execute proxied payload with Microsoft signed binary
-    Category: Execute
-    Privileges: User
-    MitreID: T1216
-    OperatingSystem: Windows 10 21H1 (likely other versions as well), Windows 11
-Full_Path:
-  - Path: C:\Windows\diagnostics\system\Audio\CL_LoadAssembly.ps1
-Code_Sample:
-  - Code:
-Detection:
-Resources:
-  - Link: https://bohops.com/2018/01/07/executing-commands-and-bypassing-applocker-with-powershell-diagnostic-scripts/
-Acknowledgement:
-  - Person: Jimmy
-    Handle: '@bohops'
----
-=======
 ---
 Name: CL_LoadAssembly.ps1
 Description: PowerShell Diagnostic Script
@@ -49,4 +23,3 @@ Acknowledgement:
   - Person: Jimmy
     Handle: '@bohops'
 ---
->>>>>>> 9135005 (Add sigma references to CL_LoadAssembly, CLMutexVerifiers entries (#221))

yml/OSScripts/pester.yml

@@ -18,6 +18,13 @@ Commands:
     Privileges: User
     MitreID: T1216
     OperatingSystem: Windows 10, Windows 11
+  - Command: Pester.bat ;calc.exe
+    Description: Execute code using Pester. Example here executes calc.exe
+    Usecase: Proxy execution
+    Category: Execute
+    Privileges: User
+    MitreID: T1216
+    OperatingSystem: Windows 10, Windows 11
 Full_Path:
   - Path: c:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat
   - Path: c:\Program Files\WindowsPowerShell\Modules\Pester\*\bin\Pester.bat
@@ -26,12 +33,16 @@ Code_Sample:
 Detection:
   - Sigma: https://github.com/SigmaHQ/sigma/blob/08ca62cc8860f4660e945805d0dd615ce75258c1/rules/windows/process_creation/win_susp_pester.yml
   - Sigma: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_pester_parent.yml
+  - Sigma: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_pester_parent.yml
 Resources:
   - Link: https://twitter.com/Oddvarmoe/status/993383596244258816
   - Link: https://twitter.com/_st0pp3r_/status/1560072680887525378
+  - Link: https://twitter.com/_st0pp3r_/status/1560072680887525378
 Acknowledgement:
   - Person: Emin Atac
     Handle: '@p0w3rsh3ll'
   - Person: Stamatis Chatzimangou
     Handle: '@_st0pp3r_'
+  - Person: Stamatis Chatzimangou
+    Handle: '@_st0pp3r_'
 ---