public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-02-28 21:13:08 +01:00
Code Issues Projects Releases Wiki Activity

Create Provlaunch.yml (#307)

Browse Source 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
Grzegorz Tworek 2023-07-25 17:16:39 +02:00 committed by GitHub
parent 4453bb1ec4
commit 7241a8b7fd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
yml/OSBinaries/Provlaunch.yml Normal file
View File

@ -0,0 +1,23 @@
---
Name: Provlaunch.exe
Description: Launcher process
Author: Grzegorz Tworek
Created: 2023-06-30
Commands:
- Command: provlaunch.exe LOLBin
Description: 'Executes command defined in the Registry. Requires 3 levels of the key structure containing some keywords. Such keys may be created with two reg.exe commands, e.g. "reg.exe add HKLM\SOFTWARE\Microsoft\Provisioning\Commands\LOLBin\dummy1 /v altitude /t REG_DWORD /d 0" and "reg add HKLM\SOFTWARE\Microsoft\Provisioning\Commands\LOLBin\dummy1\dummy2 /v Commandline /d calc.exe". Registry keys are deleted after successful execution.'
Usecase: Executes arbitrary command
Category: Execute
Privileges: Administrator
MitreID: T1218
OperatingSystem: Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022
Full_Path:
- Path: c:\windows\system32\provlaunch.exe
Detection:
- IOC: c:\windows\system32\provlaunch.exe executions
- IOC: Creation/existence of HKLM\SOFTWARE\Microsoft\Provisioning\Commands subkeys
Resources:
- Link: https://twitter.com/0gtweet/status/1674399582162153472
Acknowledgement:
- Person: Grzegorz Tworek
Handle: '@0gtweet'