From 084fb8398400b121df71b719e2faea62011aadb2 Mon Sep 17 00:00:00 2001 From: Elliot Killick Date: Thu, 26 Aug 2021 12:07:04 -0400 Subject: [PATCH] Remove .exe from command and increase specificity --- yml/OSBinaries/OfflineScannerShell.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/yml/OSBinaries/OfflineScannerShell.yml b/yml/OSBinaries/OfflineScannerShell.yml index 4487102..3bc27b0 100644 --- a/yml/OSBinaries/OfflineScannerShell.yml +++ b/yml/OSBinaries/OfflineScannerShell.yml @@ -4,8 +4,8 @@ Description: Windows Defender Offline Shell Author: 'Elliot Killick' Created: '2021-08-16' Commands: - - Command: OfflineScannerShell.exe - Description: Execute mpclient.dll library in the current directory + - Command: OfflineScannerShell + Description: Execute mpclient.dll library in the current working directory Usecase: Can be used to evade defensive countermeasures or to hide as a persistence mechanism Category: Execute Privileges: Administrator