public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-27 07:18:05 +01:00
Code Issues Projects Releases Wiki Activity

Create Setres.yml (#262)

Browse Source 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
Grzegorz Tworek 2022-10-26 12:15:13 +02:00 committed by GitHub
parent c20f388444
commit 1587eeaf6c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
yml/OSBinaries/Setres.yml Normal file
View File

@ -0,0 +1,24 @@
---
Name: Setres.exe
Description: Configures display settings
Author: Grzegorz Tworek
Created: 2022-10-21
Commands:
- Command: setres.exe -w 800 -h 600
Description: Sets the resolution and then launches 'choice' command from the working directory.
Usecase: Executes arbitrary code
Category: Execute
Privileges: User
MitreID: T1218
OperatingSystem: Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022
Full_Path:
- Path: c:\windows\system32\setres.exe
Detection:
- IOC: Unusual location for choice.exe file
- IOC: Process created from choice.com binary
- IOC: Existence of choice.cmd file
Resources:
- Link: https://twitter.com/0gtweet/status/1583356502340870144
Acknowledgement:
- Person: Grzegorz Tworek
Handle: '@0gtweet'