public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-28 15:58:24 +01:00
Code Issues Projects Releases Wiki Activity

Applying MITRE ATT&CK v15 changes (#370)

Browse Source 
https://attack.mitre.org/resources/updates/updates-april-2024/
This commit is contained in:
Wietze 2024-04-24 15:10:59 +01:00 committed by GitHub
parent 2cc01b0113
commit 2cc0ee99e6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
6 changed files with 11 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
yml/OSBinaries/Certutil.yml
View File

@ -30,7 +30,7 @@ Commands:
Usecase: Encode files to evade defensive measures Usecase: Encode files to evade defensive measures
Category: Encode Category: Encode
Privileges: User Privileges: User
MitreID: T1027 MitreID: T1027.013
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
- Command: certutil -decode encodedInputFileName decodedOutputFileName - Command: certutil -decode encodedInputFileName decodedOutputFileName
Description: Command to decode a Base64 encoded file. Description: Command to decode a Base64 encoded file.

2
yml/OSBinaries/Msedge.yml
View File

@ -23,7 +23,7 @@ Commands:
Usecase: Executes a process under a trusted Microsoft signed binary Usecase: Executes a process under a trusted Microsoft signed binary
Category: Execute Category: Execute
Privileges: User Privileges: User
MitreID: T1218 MitreID: T1218.015
OperatingSystem: Windows 10, Windows 11 OperatingSystem: Windows 10, Windows 11
Full_Path: Full_Path:
- Path: c:\Program Files\Microsoft\Edge\Application\msedge.exe - Path: c:\Program Files\Microsoft\Edge\Application\msedge.exe

2
yml/OSBinaries/msedge_proxy.yml
View File

@ -25,7 +25,7 @@ Commands:
Usecase: Executes a process under a trusted Microsoft signed binary Usecase: Executes a process under a trusted Microsoft signed binary
Category: Execute Category: Execute
Privileges: User Privileges: User
MitreID: T1218 MitreID: T1218.015
OperatingSystem: Windows 10, Windows 11 OperatingSystem: Windows 10, Windows 11
Detection: Detection:
- Sigma: https://github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_susp_electron_execution_proxy.yml - Sigma: https://github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_susp_electron_execution_proxy.yml

8
yml/OSBinaries/msedgewebview2.yml
View File

@ -9,28 +9,28 @@ Commands:
Usecase: Proxy execution of binary Usecase: Proxy execution of binary
Category: Execute Category: Execute
Privileges: Low privileges Privileges: Low privileges
MitreID: T1202 MitreID: T1218.015
OperatingSystem: Windows 10, Windows 11 OperatingSystem: Windows 10, Windows 11
- Command: msedgewebview2.exe --utility-cmd-prefix="calc.exe" - Command: msedgewebview2.exe --utility-cmd-prefix="calc.exe"
Description: This command launches the Microsoft Edge WebView2 browser control without sandboxing and will spawn calc.exe as its subprocess. Description: This command launches the Microsoft Edge WebView2 browser control without sandboxing and will spawn calc.exe as its subprocess.
Usecase: Proxy execution of binary Usecase: Proxy execution of binary
Category: Execute Category: Execute
Privileges: User Privileges: User
MitreID: T1202 MitreID: T1218.015
OperatingSystem: Windows 10, Windows 11 OperatingSystem: Windows 10, Windows 11
- Command: msedgewebview2.exe --disable-gpu-sandbox --gpu-launcher="calc.exe" - Command: msedgewebview2.exe --disable-gpu-sandbox --gpu-launcher="calc.exe"
Description: This command launches the Microsoft Edge WebView2 browser control without sandboxing and will spawn calc.exe as its subprocess. Description: This command launches the Microsoft Edge WebView2 browser control without sandboxing and will spawn calc.exe as its subprocess.
Usecase: Proxy execution of binary Usecase: Proxy execution of binary
Category: Execute Category: Execute
Privileges: User Privileges: User
MitreID: T1202 MitreID: T1218.015
OperatingSystem: Windows 10, Windows 11 OperatingSystem: Windows 10, Windows 11
- Command: msedgewebview2.exe --no-sandbox --renderer-cmd-prefix="calc.exe" - Command: msedgewebview2.exe --no-sandbox --renderer-cmd-prefix="calc.exe"
Description: This command launches the Microsoft Edge WebView2 browser control without sandboxing and will spawn calc.exe as its subprocess. Description: This command launches the Microsoft Edge WebView2 browser control without sandboxing and will spawn calc.exe as its subprocess.
Usecase: Proxy execution of binary Usecase: Proxy execution of binary
Category: Execute Category: Execute
Privileges: User Privileges: User
MitreID: T1202 MitreID: T1218.015
OperatingSystem: Windows 10, Windows 11 OperatingSystem: Windows 10, Windows 11
Full_Path: Full_Path:
- Path: C:\Program Files (x86)\Microsoft\Edge\Application\114.0.1823.43\msedgewebview2.exe - Path: C:\Program Files (x86)\Microsoft\Edge\Application\114.0.1823.43\msedgewebview2.exe

4
yml/OSScripts/Syncappvpublishingserver.yml
View File

@ -9,12 +9,10 @@ Commands:
Usecase: Use Powershell host invoked from vbs script Usecase: Use Powershell host invoked from vbs script
Category: Execute Category: Execute
Privileges: User Privileges: User
MitreID: T1216 MitreID: T1216.002
OperatingSystem: Windows 10, Windows 11 OperatingSystem: Windows 10, Windows 11
Full_Path: Full_Path:
- Path: C:\Windows\System32\SyncAppvPublishingServer.vbs - Path: C:\Windows\System32\SyncAppvPublishingServer.vbs
Code_Sample:
- Code:
Detection: Detection:
- Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.yml - Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.yml
Resources: Resources:

6
yml/OtherMSBinaries/Teams.yml
View File

@ -9,21 +9,21 @@ Commands:
Usecase: Execute JavaScript code Usecase: Execute JavaScript code
Category: Execute Category: Execute
Privileges: User Privileges: User
MitreID: T1218 MitreID: T1218.015
OperatingSystem: Windows 10, Windows 11 OperatingSystem: Windows 10, Windows 11
- Command: teams.exe - Command: teams.exe
Description: Generate JavaScript payload and package.json, archive in ASAR file and save to "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app.asar" before executing. Description: Generate JavaScript payload and package.json, archive in ASAR file and save to "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app.asar" before executing.
Usecase: Execute JavaScript code Usecase: Execute JavaScript code
Category: Execute Category: Execute
Privileges: User Privileges: User
MitreID: T1218 MitreID: T1218.015
OperatingSystem: Windows 10, Windows 11 OperatingSystem: Windows 10, Windows 11
- Command: teams.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c ping google.com &&" - Command: teams.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c ping google.com &&"
Description: Teams spawns cmd.exe as a child process of teams.exe and executes the ping command Description: Teams spawns cmd.exe as a child process of teams.exe and executes the ping command
Usecase: Executes a process under a trusted Microsoft signed binary Usecase: Executes a process under a trusted Microsoft signed binary
Category: Execute Category: Execute
Privileges: User Privileges: User
MitreID: T1218 MitreID: T1218.015
OperatingSystem: Windows 10, Windows 11 OperatingSystem: Windows 10, Windows 11
Full_Path: Full_Path:
- Path: "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\Teams.exe" - Path: "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\Teams.exe"