2023-03-31 14:46:21 +02:00
|
|
|
---
|
|
|
|
|
Name: Microsoft.NodejsTools.PressAnyKey.exe
|
|
|
|
|
Description: Part of the NodeJS Visual Studio tools.
|
|
|
|
|
Author: mr.d0x
|
|
|
|
|
Created: 2022-01-20
|
|
|
|
|
Commands:
|
|
|
|
|
- Command: Microsoft.NodejsTools.PressAnyKey.exe normal 1 cmd.exe
|
|
|
|
|
Description: Launch cmd.exe as a subprocess of Microsoft.NodejsTools.PressAnyKey.exe.
|
|
|
|
|
Usecase: Spawn a new process via Microsoft.NodejsTools.PressAnyKey.exe.
|
|
|
|
|
Category: Execute
|
|
|
|
|
Privileges: User
|
|
|
|
|
MitreID: T1127
|
|
|
|
|
OperatingSystem: Windows
|
|
|
|
|
Full_Path:
|
2024-10-02 00:14:19 +02:00
|
|
|
- Path: C:\Program Files\Microsoft Visual Studio\<version>\Community\Common7\IDE\Extensions\Microsoft\NodeJsTools\NodeJsTools\Microsoft.NodejsTools.PressAnyKey.exe
|
|
|
|
|
- Path: C:\Program Files (x86)\Microsoft Visual Studio\<version>\Community\Common7\IDE\Extensions\Microsoft\NodeJsTools\NodeJsTools\Microsoft.NodejsTools.PressAnyKey.exe
|
2023-06-10 08:12:12 +02:00
|
|
|
Detection:
|
|
|
|
|
- Sigma: https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/process_creation/proc_creation_win_renamed_pressanykey.yml
|
|
|
|
|
- Sigma: https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/process_creation/proc_creation_win_pressanykey_lolbin_execution.yml
|
2023-03-31 14:46:21 +02:00
|
|
|
Resources:
|
|
|
|
|
- Link: https://twitter.com/mrd0x/status/1463526834918854661
|
|
|
|
|
Acknowledgement:
|
|
|
|
|
- Person: mr.d0x
|
|
|
|
|
Handle: '@mrd0x'
|
