diff --git a/yml/OtherMSBinaries/winfile.yml b/yml/OtherMSBinaries/winfile.yml new file mode 100644 index 00000000..f0171ed3 --- /dev/null +++ b/yml/OtherMSBinaries/winfile.yml @@ -0,0 +1,24 @@ +--- +Name: winfile.exe +Description: Windows File Manager executable +Author: Avihay Eldad +Created: 2024-04-30 +Commands: + - Command: winfile.exe calc.exe + Description: Execute an executable file with WinFile as a parent process. + Usecase: Performs execution of specified file, can be used as a defense evasion + Category: Execute + Privileges: User + MitreID: T1202 + OperatingSystem: Windows 10, Windows 11 +Full_Path: + - Path: C:\Windows\System32\winfile.exe + - Path: C:\Windows\winfile.exe + - Path: C:\Program Files\WinFile\winfile.exe + - Path: C:\Program Files (x86)\WinFile\winfile.exe + - Path: C:\Program Files\WindowsApps\Microsoft.WindowsFileManager_10.3.0.0_x64__8wekyb3d8bbwe\WinFile\winfile.exe +Resources: + - Link: https://github.com/microsoft/winfile +Acknowledgement: + - Person: Avihay Eldad + Handle: '@AvihayEldad'