public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-07-27 12:42:19 +02:00
Code Issues Projects Releases Wiki Activity

Added Office binaries from jreegun to the project. Pull request 42

Browse Source
This commit is contained in:
Oddvar Moe
2019-09-17 22:58:03 +02:00
parent 0644ac30d7
commit 32757cd0c3
2 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
yml/OtherMSBinaries/Winword.yml
View File

@@ -1,6 +1,6 @@
---
Name: Winword.exe
Description: Microsoft Office binary.
Description: Microsoft Office binary
Author: 'Reegun J (OCBC Bank)'
Created: '2019-07-19'
Commands:
@@ -28,10 +28,14 @@ Full_Path:
- Path: C:\Program Files (x86)\Microsoft Office\Office12\winword.exe
- Path: C:\Program Files\Microsoft Office\Office12\winword.exe
- Path: C:\Program Files\Microsoft Office\Office12\winword.exe
Code_Sample:
- Code:
Detection:
- IOC:
Resources:
- Link: https://twitter.com/reegun21/status/1150032506504151040
- Link: https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191
Acknowledgement:
- Person: Reegun J (OCBC Bank)
- Person: 'Reegun J (OCBC Bank)'
Handle: '@reegun21'
---