public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-07-27 12:42:19 +02:00
Code Issues Projects Releases Wiki Activity

Merge remote-tracking branch 'upstream/master' into windows_11_sprint

Browse Source
This commit is contained in:
Wietze
2022-10-03 16:16:30 +01:00
parent e1df4e9f83 da38f3d8ed
commit 67e1040172
176 changed files with 502 additions and 341 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
yml/OSBinaries/Infdefaultinstall.yml
View File

@@ -15,10 +15,10 @@ Full_Path:
- Path: C:\Windows\System32\Infdefaultinstall.exe
- Path: C:\Windows\SysWOW64\Infdefaultinstall.exe
Code_Sample:
- Code: https://gist.github.com/KyleHanslovan/5e0f00d331984c1fb5be32c40f3b265a
- Code: https://gist.github.com/KyleHanslovan/5e0f00d331984c1fb5be32c40f3b265a
Detection:
- Sigma: https://github.com/SigmaHQ/sigma/blob/85d47aeabc25bbd023284849f4466c1e00b855ce/rules/windows/process_creation/process_creation_infdefaultinstall.yml
- BlockRule: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
- Sigma: https://github.com/SigmaHQ/sigma/blob/85d47aeabc25bbd023284849f4466c1e00b855ce/rules/windows/process_creation/process_creation_infdefaultinstall.yml
- BlockRule: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
Resources:
- Link: https://twitter.com/KyleHanslovan/status/911997635455852544
- Link: https://blog.conscioushacker.io/index.php/2017/10/25/evading-microsofts-autoruns/
@@ -26,4 +26,3 @@ Resources:
Acknowledgement:
- Person: Kyle Hanslovan
Handle: '@kylehanslovan'
---