7 new dlls, x64 tested only (wietze#50)

Co-authored-by: Gary Lobermier <[email protected]>
Co-authored-by: Wietze <[email protected]>

yml/microsoft/built-in/dbgmodel.yml

@@ -0,0 +1,18 @@
+---
+Name: dbgmodel.dll
+Author: Gary Lobermier
+Created: 2023-05-22
+Vendor: Microsoft
+ExpectedLocations:
+  - '%SYSTEM32%'
+  - '%SYSWOW64%'
+  - '%PROGRAMFILES%\Windows Kits\10\Debuggers\%VERSION%'
+ExpectedSignatureInformation:
+  - Subject: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
+    Issuer: CN=Microsoft Windows Production PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
+    Type: Catalog
+VulnerableExecutables:
+  - Path: '%PROGRAMFILES%\Windows Kits\10\Debuggers\%VERSION%\ntsd.exe'
+    Type: Sideloading
+Resources:
+  - https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/

yml/microsoft/built-in/textshaping.yml

@@ -0,0 +1,19 @@
+---
+Name: textshaping.dll
+Author: Gary Lobermier
+Created: 2023-05-22
+Vendor: Microsoft
+ExpectedLocations:
+  - '%SYSTEM32%'
+  - '%SYSWOW64%'
+ExpectedSignatureInformation:
+  - Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
+    Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
+    Type: Catalog
+VulnerableExecutables:
+  - Path: '%PROGRAMFILES%\Windows Kits\10\Debuggers\x64\logger.exe'
+    Type: Sideloading
+  - Path: '%PROGRAMFILES%\Windows Kits\10\Debuggers\x64\logviewer.exe'
+    Type: Sideloading
+Resources:
+  - https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/

yml/microsoft/built-in/wsdapi.yml

@@ -0,0 +1,13 @@
+---
+Name: wsdapi.dll
+Author: Gary Lobermier
+Created: 2023-05-22
+Vendor: Microsoft
+ExpectedLocations:
+  - '%SYSTEM32%'
+  - '%SYSWOW64%'
+VulnerableExecutables:
+  - Path: '%PROGRAMFILES%\Windows Kits\10\bin\%VERSION%\x64\wsddebug_host.exe'
+    Type: Sideloading
+Resources:
+  - https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/

yml/microsoft/external/gflagsui.yml

@@ -0,0 +1,17 @@
+---
+Name: gflagsui.dll
+Author: Gary Lobermier
+Created: 2023-05-22
+Vendor: Microsoft
+ExpectedLocations:
+  - '%PROGRAMFILES%\Windows Kits\10\Debuggers\%VERSION%'
+ExpectedSignatureInformation:
+  - Subject: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
+    Issuer: CN=Microsoft Windows Production PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
+    Type: Catalog
+VulnerableExecutables:
+  - Path: '%PROGRAMFILES%\Windows Kits\10\Debuggers\%VERSION%\gflags.exe'
+    Type: Sideloading
+    AutoElevate: true
+Resources:
+  - https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/

yml/microsoft/external/rcdll.yml

@@ -0,0 +1,16 @@
+---
+Name: rcdll.dll
+Author: Gary Lobermier
+Created: 2023-05-22
+Vendor: Microsoft
+ExpectedLocations:
+  - '%PROGRAMFILES%\Windows Kits\10\bin\%VERSION%\%VERSION%'
+ExpectedSignatureInformation:
+  - Subject: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
+    Issuer: CN=Microsoft Windows Production PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
+    Type: Catalog
+VulnerableExecutables:
+  - Path: '%PROGRAMFILES%\Windows Kits\10\bin\%VERSION%\%VERSION%\rc.exe'
+    Type: Sideloading
+Resources:
+  - https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/

yml/microsoft/external/symsrv.yml

@@ -0,0 +1,16 @@
+---
+Name: symsrv.dll
+Author: Gary Lobermier
+Created: 2023-05-22
+Vendor: Microsoft
+ExpectedLocations:
+  - '%PROGRAMFILES%\Windows Kits\10\Debuggers\%VERSION%'
+ExpectedSignatureInformation:
+  - Subject: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
+    Issuer: CN=Microsoft Windows Production PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
+    Type: Catalog
+VulnerableExecutables:
+  - Path: '%PROGRAMFILES%\Windows Kits\10\Debuggers\%VERSION%\symstore.exe'
+    Type: Sideloading
+Resources:
+  - https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/

yml/microsoft/external/windowsperformancerecorderui.yml

@@ -0,0 +1,17 @@
+---
+Name: windowsperformancerecorderui.dll
+Author: Gary Lobermier
+Created: 2023-05-22
+Vendor: Microsoft
+ExpectedLocations:
+  - '%PROGRAMFILES%\Windows Kits\10\Windows Performance Toolkit'
+ExpectedSignatureInformation:
+  - Subject: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
+    Issuer: CN=Microsoft Windows Production PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
+    Type: Catalog
+VulnerableExecutables:
+  - Path: '%PROGRAMFILES%\Windows Kits\10\Windows Performance Toolkit\WPRUI.exe'
+    Type: Sideloading
+    AutoElevate: true
+Resources:
+  - https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/