diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 91dc370d..d8e1b824 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -10852,7 +10852,7 @@ defense-evasion: default: explorer dll_path: description: Path of the dll to inject - type: string + type: path default: PathToAtomicsFolder\T1502\bin\calc.dll dll_process_name: description: Name of the created process from the injected dll @@ -10860,7 +10860,7 @@ defense-evasion: default: calculator spawnto_process_path: description: Path of the process to spawn - type: string + type: path default: C:\Program Files\Internet Explorer\iexplore.exe spawnto_process_name: description: Name of the process to spawn @@ -14780,7 +14780,7 @@ privilege-escalation: default: explorer dll_path: description: Path of the dll to inject - type: string + type: path default: PathToAtomicsFolder\T1502\bin\calc.dll dll_process_name: description: Name of the created process from the injected dll @@ -14788,7 +14788,7 @@ privilege-escalation: default: calculator spawnto_process_path: description: Path of the process to spawn - type: string + type: path default: C:\Program Files\Internet Explorer\iexplore.exe spawnto_process_name: description: Name of the process to spawn diff --git a/atomics/T1502/T1502.md b/atomics/T1502/T1502.md index 5030475c..fed59525 100644 --- a/atomics/T1502/T1502.md +++ b/atomics/T1502/T1502.md @@ -29,9 +29,9 @@ Credit to In Ming Loh (https://github.com/countercept/ppid-spoofing/blob/master/ | Name | Description | Type | Default Value | |------|-------------|------|---------------| | parent_process_name | Name of the parent process | string | explorer| -| dll_path | Path of the dll to inject | string | PathToAtomicsFolder\T1502\bin\calc.dll| +| dll_path | Path of the dll to inject | path | PathToAtomicsFolder\T1502\bin\calc.dll| | dll_process_name | Name of the created process from the injected dll | string | calculator| -| spawnto_process_path | Path of the process to spawn | string | C:\Program Files\Internet Explorer\iexplore.exe| +| spawnto_process_path | Path of the process to spawn | path | C:\Program Files\Internet Explorer\iexplore.exe| | spawnto_process_name | Name of the process to spawn | string | iexplore|