From 64914b641ceb5b0c4519030ba2b3070b48722b24 Mon Sep 17 00:00:00 2001 From: Oddvar Moe Date: Thu, 21 Jan 2021 22:48:05 +0100 Subject: [PATCH] Adjusted error on pnputil yml file --- yml/OSBinaries/pnputil.exe | 29 ----------------------------- yml/OSBinaries/pnputil.yml | 23 +++++++++++++++++++++++ 2 files changed, 23 insertions(+), 29 deletions(-) delete mode 100644 yml/OSBinaries/pnputil.exe create mode 100644 yml/OSBinaries/pnputil.yml diff --git a/yml/OSBinaries/pnputil.exe b/yml/OSBinaries/pnputil.exe deleted file mode 100644 index 3ce817e..0000000 --- a/yml/OSBinaries/pnputil.exe +++ /dev/null @@ -1,29 +0,0 @@ ---- -Name: Pnputil.exe -Description: used for Install drivers. -Author: Hai vaknin (lux) -Created: 25/12/2020 -Commands: - - Command: - pnputil.exe -i -a C:\Users\hai\Desktop\mo.inf - Description: used for Install drivers - Usecase: add malicious driver. - Category: Execution - Privileges required:Administrator. - MitreID: - MitreLink: - OperatingSystem: Windows 10,7 - -Full_Path: - - Path: - C:\Windows\system32\pnputil.exe - -Code_Sample: -https://github.com/LuxNoBulIshit/test.inf/blob/main/inf -Acknowledgement: - - Person: -Hai Vaknin(Lux) https://github.com/LuxNoBulIshit -Avihay eldad -AlonEliassaf http://github.com/aloneliassaf - ---- diff --git a/yml/OSBinaries/pnputil.yml b/yml/OSBinaries/pnputil.yml new file mode 100644 index 0000000..fd6dbd8 --- /dev/null +++ b/yml/OSBinaries/pnputil.yml @@ -0,0 +1,23 @@ +--- +Name: Pnputil.exe +Description: used for Install drivers. +Author: Hai vaknin (lux) +Created: 25/12/2020 +Commands: + - Command: pnputil.exe -i -a C:\Users\hai\Desktop\mo.inf + Description: used for Install drivers + Usecase: add malicious driver. + Category: Execution + Privileges: Administrator + MitreID: T1215 + MitreLink: https://attack.mitre.org/techniques/T1215 + OperatingSystem: Windows 10,7 +Full_Path: + - Path: C:\Windows\system32\pnputil.exe +Code_Sample: https://github.com/LuxNoBulIshit/test.inf/blob/main/inf +Acknowledgement: + - Person: Hai Vaknin(Lux) + Handle: 'LuxNoBulIshit' + - Person: Avihay eldad + Handle: 'aloneliassaf' +---