public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-07-27 04:32:24 +02:00
Code Issues Projects Releases Wiki Activity

Detection Resources and Other Updates (#179)

Browse Source 
* Add detection links for scripts

* Add detection links for OtherMSBins. Fixed and updated as needed.

* Add detection links for MSBins. Fixed and updated as needed.

* Add detection links for oslibraries

* Updating template for Detections

* Removing empty Detection:Sigma entries

* Remove redundant blank line

* Replacing commit URL with file URL

Co-authored-by: root <root@DESKTOP-5CR935D.localdomain>
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
bohops
2021-11-15 08:19:03 -05:00
committed by GitHub
parent 2031916b1a
commit 23dd0236ae
145 changed files with 558 additions and 181 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
yml/OSBinaries/Ilasm.yml
View File

@@ -5,14 +5,14 @@ Author: Hai vaknin (lux)
Created: 2020-03-17
Commands:
- Command: ilasm.exe C:\public\test.txt /exe
Description: Binary file used by .NET to compile c# code to .exe
Description: Binary file used by .NET to compile C#/intermediate (IL) code to .exe
Usecase: Compile attacker code on system. Bypass defensive counter measures.
Category: Compile
Privileges: User
MitreID: T1127
OperatingSystem: Windows 10,7
- Command: ilasm.exe C:\public\test.txt /dll
Description: Binary file used by .NET to compile c# code to dll
Description: Binary file used by .NET to compile C#/intermediate (IL) code to dll
Usecase: A description of the usecase
Category: Compile
Privileges: User
@@ -21,7 +21,9 @@ Full_Path:
- Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
- Path: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
Code_Sample:
- Code:
- Code:
Detection:
- IOC: Ilasm may not be used often in production environments (such as on endpoints)
Resources:
- Link: https://github.com/LuxNoBulIshit/BeforeCompileBy-ilasm/blob/master/hello_world.txt
Acknowledgement: