public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-25 14:29:24 +01:00
Code Issues Projects Releases Wiki Activity

Delete Update.yml

Browse Source
This commit is contained in:
jesgal 2020-11-01 20:05:25 +01:00 committed by GitHub
parent 748cfb4223
commit 4c67be51c1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 0 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
yml/LOLUtilz/OtherBinaries/Update.yml
View File

@ -1,18 +0,0 @@
---
Name: Update.exe
Description: Binary to update the existing installed Nuget/squirrel package. Part of Whatsapp installation.
Author: 'Jesus Galvez'
Created: '2020-11-01'
- Command: Update.exe --processStart payload.exe --process-start-args "whatever args"
Description: Copy your payload into "%localappdata%\Whatsapp\app-[version]\". Then run the command. Update.exe will execute the file you copied.
Usecase: Execute binary
Category: Execute
Privileges: User
MitreID: T1218
MitreLink: https://attack.mitre.org/techniques/T1218/
OperatingSystem: Windows 7 and up with Whatsapp installed
Full_Path:
- Path: '%localappdata%\Whatsapp\Update.exe'
Detection:
- IOC: "%localappdata%\Whatsapp\Update.exe" spawned an unknown process
---