public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-07-27 04:32:24 +02:00
Code Issues Projects Releases Wiki Activity

Adding and updating various LOLBINS (#229)

Browse Source 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
Nasreddine Bencherchali
2022-11-11 17:42:44 +01:00
committed by GitHub
parent 1587eeaf6c
commit 0d7efb8ead
8 changed files with 150 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
yml/OtherMSBinaries/OpenConsole.yml Normal file
View File

@@ -0,0 +1,25 @@
---
Name: OpenConsole.exe
Description: Console Window host for Windows Terminal
Author: Nasreddine Bencherchali
Created: 2022-06-17
Commands:
- Command: "OpenConsole.exe calc"
Description: Execute calc with OpenConsole.exe as parent process
Usecase: Use OpenConsole.exe as a proxy binary to evade defensive counter-measures
Category: Execute
Privileges: User
MitreID: T1202
OperatingSystem: Windows 10, Windows 11
Full_Path:
- Path: C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\Common7\IDE\CommonExtensions\Microsoft\Terminal\ServiceHub\os64\OpenConsole.exe
- Path: C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\Common7\IDE\CommonExtensions\Microsoft\Terminal\ServiceHub\os86\OpenConsole.exe
- Path: C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\Terminal\ServiceHub\os64\OpenConsole.exe
Detection:
- IOC: OpenConsole.exe spawning unexpected processes
- Sigma: https://github.com/SigmaHQ/sigma/blob/9e0ef7251b075f15e7abafbbec16d3230c5fa477/rules/windows/process_creation/proc_creation_win_lolbin_openconsole.yml
Resources:
- Link: https://twitter.com/nas_bench/status/1537563834478645252
Acknowledgement:
- Person: Nasreddine Bencherchali
Handle: '@nas_bench'