template.yml

---
Name: nameofthedll.dll # All lower case, must match filename (in this case it would be nameofthedll.yml)
Author: Author Name
Created: 2023-01-01
Vendor: Vendor Name
CVE: CVE-2000-1234 # Or remove line if not applicable
ExpectedLocations: # No trailing slashes
  - '%SYSTEM32%'
  - '%SYSWOW64%'
  - '%PROGRAMFILES%'
  - 'C:\some\file\location' # As long as you use single quotes, you won't have to escape your backslashes
  - ...
VulnerableExecutables:
  - Path: 'c:\path\to\the\executable.exe'
    Type: Phantom|Sideloading|Search Order|Environment Variable
    AutoElevate: true # Remove line if false
    PrivilegeEscalation: true # Remove line if false
    Condition: 'version >= 1.2.3.4' # Remove line if not applicable
    Variable: SYSTEMROOT # Only if Type=="Environment Variable"; remove line otherwise
    SHA256: # Remove line if not a 3rd-party entry
      - 'for 3rd-party entries, provide a SHA-256 hash'
  - ...
Resources:
  - https://some-link.here
  - ...
Acknowledgements:
  - Name: Full Name or Twitter Screen Name
    Twitter: '@twitter-handle' # Has to start with @; remove line if not applicable
  - ...