From f080b42594cc7a41a7b22c9c4dfa7c2c0ab37ca6 Mon Sep 17 00:00:00 2001
From: hegusung <7390383+hegusung@users.noreply.github.com>
Date: Sun, 13 Oct 2024 22:36:35 +0200
Subject: [PATCH] Update VSDiagnostics.yml Tags

Added Tags:
Execute EXE
---
 yml/OtherMSBinaries/VSDiagnostics.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/yml/OtherMSBinaries/VSDiagnostics.yml b/yml/OtherMSBinaries/VSDiagnostics.yml
index 88ccc88..ba2b6ba 100644
--- a/yml/OtherMSBinaries/VSDiagnostics.yml
+++ b/yml/OtherMSBinaries/VSDiagnostics.yml
@@ -11,6 +11,8 @@ Commands:
     Privileges: User
     MitreID: T1127
     OperatingSystem: Windows 10, Windows 11
+    Tags:
+      - Execute: EXE
   - Command: VSDiagnostics.exe start 2 /launch:cmd.exe /launchArgs:"/c calc.exe"
     Description: Starts a collection session with sessionID 2 and calls kernelbase.CreateProcessW to launch specified executable. Arguments specified in launchArgs are passed to CreateProcessW.
     Usecase: Proxy execution of binary with arguments
@@ -18,6 +20,8 @@ Commands:
     Privileges: User
     MitreID: T1127
     OperatingSystem: Windows 10, Windows 11
+    Tags:
+      - Execute: EXE
 Full_Path:
   - Path: C:\Program Files\Microsoft Visual Studio\2022\Community\Team Tools\DiagnosticsHub\Collector\VSDiagnostics.exe
 Detection: