public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-07-27 04:32:24 +02:00
Code Issues Projects Releases Wiki Activity

Standardise date formats (see https://yaml.org/type/timestamp.html)

Browse Source
This commit is contained in:
Wietze
2021-01-10 15:04:52 +00:00
parent de50a47957
commit 14dca38278
147 changed files with 407 additions and 407 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
yml/OSBinaries/At.yml
View File

@@ -2,12 +2,12 @@
Name: At.exe
Description: Schedule periodic tasks
Author: 'Freddie Barr-Smith'
Created: '2019-09-20'
Created: 2019-09-20
Commands:
- Command: C:\Windows\System32\at.exe at 09:00 /interactive /every:m,t,w,th,f,s,su C:\Windows\System32\revshell.exe
Description: Create a recurring task to execute every day at a specific time.
Description: Create a recurring task to execute every day at a specific time.
Usecase: Create a recurring task, to eg. to keep reverse shell session(s) alive
Category: Execute
Category: Execute
Privileges: Local Admin
MitreID: T1053
MitreLink: https://attack.mitre.org/wiki/Technique/T1053
@@ -17,10 +17,10 @@ Full_Path:
- Path: C:\WINDOWS\SysWOW64\At.exe
Detection:
- IOC: Scheduled task is created
- IOC: Windows event log - type 3 login
- IOC: Windows event log - type 3 login
- IOC: C:\Windows\System32\Tasks\At1 (substitute 1 with subsequent number of at job)
- IOC: C:\Windows\Tasks\At1.job
- IOC: Registry Key - Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\At1.
- IOC: Registry Key - Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\At1.
Resources:
- Link: https://freddiebarrsmith.com/at.txt
- Link: https://sushant747.gitbooks.io/total-oscp-guide/privilege_escalation_windows.html - Escalate to System from Administrator