mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2025-07-27 12:42:19 +02:00
MITRE ATT&CK realignment sprint
This commit is contained in:
@@ -10,7 +10,6 @@ Commands:
|
||||
Category: Execute
|
||||
Privileges: User
|
||||
MitreID: T1055
|
||||
MitreLink: https://attack.mitre.org/wiki/Technique/T1055
|
||||
OperatingSystem: Windows
|
||||
- Command: coregen.exe dummy_assembly_name
|
||||
Description: Loads the coreclr.dll in the corgen.exe directory (e.g. C:\Program Files\Microsoft Silverlight\5.1.50918.0).
|
||||
@@ -18,7 +17,6 @@ Commands:
|
||||
Category: Execute
|
||||
Privileges: User
|
||||
MitreID: T1055
|
||||
MitreLink: https://attack.mitre.org/wiki/Technique/T1055
|
||||
OperatingSystem: Windows
|
||||
- Command: coregen.exe /L C:\folder\evil.dll dummy_assembly_name
|
||||
Description: Loads the target .DLL in arbitrary path specified with /L. Since binary is signed it can also be used to bypass application whitelisting solutions.
|
||||
@@ -26,13 +24,12 @@ Commands:
|
||||
Category: AWL Bypass
|
||||
Privileges: User
|
||||
MitreID: T1218
|
||||
MitreLink: https://attack.mitre.org/wiki/Technique/T1218
|
||||
OperatingSystem: Windows
|
||||
Full_Path:
|
||||
- Path: C:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe
|
||||
- Path: C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\coregen.exe
|
||||
Code_Sample:
|
||||
- Code:
|
||||
Code_Sample:
|
||||
- Code:
|
||||
Detection:
|
||||
- IOC: coregen.exe loading .dll file not in "C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\"
|
||||
- IOC: coregen.exe loading .dll file not named coreclr.dll
|
||||
@@ -44,9 +41,9 @@ Resources:
|
||||
- Link: https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
|
||||
Acknowledgement:
|
||||
- Person: Nicky Tyrer
|
||||
Handle:
|
||||
Handle:
|
||||
- Person: Evan Pena
|
||||
Handle:
|
||||
Handle:
|
||||
- Person: Casey Erikson
|
||||
Handle:
|
||||
Handle:
|
||||
---
|
||||
|
Reference in New Issue
Block a user