mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2025-07-27 04:32:24 +02:00
MITRE ATT&CK realignment sprint
This commit is contained in:
@@ -10,7 +10,6 @@ Commands:
|
||||
Category: Execute
|
||||
Privileges: User
|
||||
MitreID: T1202
|
||||
MitreLink: https://attack.mitre.org/techniques/T1202
|
||||
OperatingSystem: Windows 8.1 and higher, Windows Server 2012 and higher.
|
||||
- Command: procdump.exe -md calc.dll foobar
|
||||
Description: Loads calc.dll where configured with DLL_PROCESS_ATTACH execution, process argument can be arbitrary.
|
||||
@@ -18,12 +17,14 @@ Commands:
|
||||
Category: Execute
|
||||
Privileges: User
|
||||
MitreID: T1202
|
||||
MitreLink: https://attack.mitre.org/techniques/T1202
|
||||
OperatingSystem: Windows 8.1 and higher, Windows Server 2012 and higher.
|
||||
Detection:
|
||||
Detection:
|
||||
- IOC: Process creation with given '-md' parameter
|
||||
- IOC: Anomalous child processes of procdump
|
||||
- IOC: Unsigned DLL load via procdump.exe or procdump64.exe
|
||||
Resources:
|
||||
- Link: https://twitter.com/ajpc500/status/1448588362382778372?s=20
|
||||
Acknowledgement:
|
||||
- Name: Alfie Champion
|
||||
Handle: '@ajpc500'
|
||||
---
|
||||
|
Reference in New Issue
Block a user