Adding mscopilot.exe and mscopilot_proxy.exe (#497)

Co-authored-by: Wietze <wietze@users.noreply.github.com>

yml/OtherMSBinaries/Mscopilot.yml

@@ -0,0 +1,22 @@
+---
+Name: Mscopilot.exe
+Description: Microsoft Copilot app
+Author: 4n4s4zi
+Created: 2026-04-14
+Commands:
+  - Command: mscopilot.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher="{CMD} && taskkill /f /im mscopilot.exe &&"
+    Description: "`mscopilot.exe` will spawn the provided command. Parent `mscopilot.exe` process needs to be killed to avoid command being executed an infinite number of times."
+    Usecase: Executes a process under a trusted Microsoft signed binary
+    Category: Execute
+    Privileges: User
+    MitreID: T1218.015
+    OperatingSystem: Windows 11
+    Tags:
+      - Execute: CMD
+Full_Path:
+  - Path: C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot.exe
+Resources:
+  - Link: https://github.com/4n4s4zi/tour-de-mscopilot
+Acknowledgement:
+  - Person: 4n4s4zi
+    Handle: '@4n4s4zi'

yml/OtherMSBinaries/Mscopilot_proxy.yml

@@ -0,0 +1,23 @@
+---
+Name: Mscopilot_proxy.exe
+Description: Microsoft Copilot proxy launcher
+Author: 4n4s4zi
+Created: 2026-04-14
+Commands:
+  - Command: mscopilot_proxy.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher="cmd.exe /c calc.exe && taskkill /f /im mscopilot.exe &&"
+    Description: "`mscopilot_proxy.exe` will spawn the provided command. Parent `mscopilot_proxy.exe` process needs to be killed to avoid command being executed an infinite number of times."
+    Usecase: Executes a process under a trusted Microsoft signed binary
+    Category: Execute
+    Privileges: User
+    MitreID: T1218.015
+    OperatingSystem: Windows 11
+    Tags:
+      - Execute: CMD
+Full_Path:
+  - Path: C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot_proxy.exe
+Detection:
+Resources:
+  - Link: https://github.com/4n4s4zi/tour-de-mscopilot
+Acknowledgement:
+  - Person: 4n4s4zi
+    Handle: '@4n4s4zi'