public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-10-23 00:58:42 +02:00
Code Issues Projects Releases Wiki Activity

Merge pull request #245 from gtworek/patch-1

Browse Source 
Create Ldifde.yml
This commit is contained in:
Conor Richard 2022-09-17 00:09:22 -04:00 committed by GitHub
commit 61043ccf0b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 30 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
yml/OSBinaries/Ldifde.yml Normal file
View File

@ -0,0 +1,30 @@
---
Name: Ldifde.exe
Description: Creates, modifies, and deletes LDAP directory objects.
Author: 'Grzegorz Tworek'
Created: 2022-08-31
Commands:
- Command: Ldifde -i -f inputfile.ldf
Description: Import inputfile.ldf into LDAP. If the file contains http-based attrval-spec such as thumbnailPhoto:< http://example.org/somefile.txt, the file will be downloaded into IE temp folder.
Usecase: Download file from Internet
Category: Download
Privileges: Administrator
MitreID: T1105
OperatingSystem: Windows Server with AD Domain Services role, Windows 10 with AD LDS role.
Full_Path:
- Path: c:\windows\system32\ldifde.exe
- Path: c:\windows\syswow64\ldifde.exe
Code_Sample:
- Code:
Detection:
- IOC:
- Analysis:
- Sigma:
- Elastic:
- Splunk:
- BlockRule:
Resources:
- Link: https://twitter.com/0gtweet/status/1564968845726580736
Acknowledgement:
- Person: Grzegorz Tworek
Handle: '@0gtweet'