public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-25 14:29:24 +01:00
Code Issues Projects Releases Wiki Activity

replacing ie4unit occurrences with ie4uinit

Browse Source
This commit is contained in:
Santiago Bruno 2019-01-23 20:04:12 -03:00
parent aba9538581
commit 7252652920
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
yml/OSBinaries/Ie4unit.yml
View File

@ -1,10 +1,10 @@
---
Name: Ie4unit.exe
Name: Ie4uinit.exe
Description:
Author: 'Oddvar Moe'
Created: '2018-05-25'
Commands:
- Command: ie4unit.exe -BaseSettings
- Command: ie4uinit.exe -BaseSettings
Description: Executes commands from a specially prepared ie4uinit.inf file.
Usecase: Get code execution by copy files to another location
Category: Execute
@ -13,14 +13,14 @@ Commands:
MitreLink: https://attack.mitre.org/wiki/Technique/T1218
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Full_Path:
- Path: c:\windows\system32\ie4unit.exe
- Path: c:\windows\sysWOW64\ie4unit.exe
- Path: c:\windows\system32\ie4uinit.exe
- Path: c:\windows\sysWOW64\ie4uinit.exe
- Path: c:\windows\system32\ieuinit.inf
- Path: c:\windows\sysWOW64\ieuinit.inf
Code_Sample:
- Code:
Detection:
- IOC: ie4unit.exe loading a inf file from outside %windir%
- IOC: ie4uinit.exe loading a inf file from outside %windir%
Resources:
- Link: https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/
Acknowledgement: