public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-11-04 02:29:34 +01:00
Code Issues Projects Releases Wiki Activity

Added detection details on mpcmdrun

Browse Source
This commit is contained in:
Oddvar Moe
2020-09-03 15:29:32 +02:00
parent 5c5a218faf
commit 63c9bc97c3
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
yml/OSBinaries/MpCmdRun.yml
View File

@@ -29,10 +29,13 @@ Code_Sample:
Detection:
- IOC: MpCmdRun storing data into alternate data streams.
- IOC: MpCmdRun getting a file from a remote machine or the internet that is not expected.
- IOC: Monitor process creation for non-SYSTEM and non-LOCAL SERVICE accounts launching mpcmdrun.exe.
- IOC: Monitor for the creation of %USERPROFILE%\AppData\Local\Temp\MpCmdRun.log
Resources:
- Link: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus
- Link: https://twitter.com/mohammadaskar2/status/1301263551638761477
- Link: https://twitter.com/Oddvarmoe/status/1301444858910052352
- Link: https://twitter.com/NotMedic/status/1301506813242867720
Acknowledgement:
- Person: Askar
Handle: '@mohammadaskar2'