Add RDS Binaries

yml/OSBinaries/Change.yml

@@ -0,0 +1,24 @@
+---
+Name: Change.exe
+Description: Remote Desktop Services MultiUser Change Utility
+Author: 'Idan Lerman'
+Created: 2025-07-31
+Commands:
+  - Command: change.exe user
+    Description: Once executed, `change.exe` will execute `chgusr.exe` in the same folder. Thus, if `change.exe` is copied to a folder and an arbitrary executable is renamed to `chgusr.exe`, `change.exe` will spawn it. Instead of `user`, it is also possible to use `port` or `logon` as command-line option.
+    Usecase: Execute an arbitrary executable via trusted system executable.
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    OperatingSystem: Windows 10, Windows 11
+    Tags:
+      - Execute: EXE
+      - Requires: Rename
+Full_Path:
+  - Path: c:\windows\system32\change.exe
+  - Path: c:\windows\syswow64\change.exe
+Detection:
+  - IOC: change.exe being executed and executes a child process outside of its normal path of c:\windows\system32\ or c:\windows\syswow64\
+Acknowledgement:
+  - Person: Idan Lerman
+    Handle: '@IdanLerman'

yml/OSBinaries/Query.yml

@@ -0,0 +1,24 @@
+---
+Name: Query.exe
+Description: Remote Desktop Services MultiUser Query Utility
+Author: Idan Lerman
+Created: 2025-07-31
+Commands:
+  - Command: query.exe user
+    Description: Once executed, `query.exe` will execute `quser.exe` in the same folder. Thus, if `query.exe` is copied to a folder and an arbitrary executable is renamed to `quser.exe`, `query.exe` will spawn it. Instead of `user`, it is also possible to use `session`, `termsession` or `process` as command-line option.
+    Usecase: Execute an arbitrary executable via trusted system executable.
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    OperatingSystem: Windows 10, Windows 11
+    Tags:
+      - Execute: EXE
+      - Requires: Rename
+Full_Path:
+  - Path: c:\windows\system32\query.exe
+  - Path: c:\windows\syswow64\query.exe
+Detection:
+  - IOC: query.exe being executed and executes a child process outside of its normal path of c:\windows\system32\ or c:\windows\syswow64\
+Acknowledgement:
+  - Person: Idan Lerman
+    Handle: '@IdanLerman'