diff --git a/.github/workflows/yaml-linting.yml b/.github/workflows/yaml-linting.yml index f7247f4..e5d948f 100644 --- a/.github/workflows/yaml-linting.yml +++ b/.github/workflows/yaml-linting.yml @@ -9,7 +9,13 @@ jobs: steps: - uses: actions/checkout@v3 - name: Check file extensions - run: if [[ $(find "${GITHUB.WORKSPACE}/yml" -type f -not -name "*.yml") ]]; then echo "Files with unexpected extension found, please ensure you use '.yml' (all lower case) for files in the yml/ folder."; exit 1; fi + run: | + files=$(find "$GITHUB_WORKSPACE/yml" -type f -not -name "*.yml"); + if [[ $files ]]; then + echo "Files with unexpected extension found, please ensure you use '.yml' (all lower case) for files in the yml/ folder."; + for i in $files; do echo "::error file=$i,line=1::Unexpected extension"; done + exit 1; + fi - name: yaml-lint uses: ibiqlik/action-yamllint@v3 with: diff --git a/yml/OSBinaries/vstest.yaml b/yml/OSBinaries/vstest.yaml deleted file mode 100644 index c68373b..0000000 --- a/yml/OSBinaries/vstest.yaml +++ /dev/null @@ -1,24 +0,0 @@ ---- -Name: vstest.console.exe -Description: VSTest.Console.exe is the command-line tool to run tests -Author: Onat Uzunyayla -Created: 2023-09-08 -Commands: - - Command: vstest.console.exe testcode.dll - Description: Executes the test methods inside the crafted dll file - Usecase: Proxy Execution, Adversaries may run malicious code embedded inside the test methods of crafted dll/exe - Category: AWL Bypass - Privileges: User - MitreID: T1127 - OperatingSystem: Windows 10, Windows 11 -Full_Path: - - Path: C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe - - Path: C:\Program Files (x86)\Microsoft Visual Studio\2022\TestAgent\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe -Code_Sample: - - Code: https://github.com/onatuzunyayla/vstest-lolbin-example/ -Detection: - - IOC: vstest.console.exe spawning unexpected processes -Resources: - - Link: https://learn.microsoft.com/en-us/visualstudio/test/vstest-console-options?view=vs-2022 -Acknowledgement: - - Person: Ayberk Halac \ No newline at end of file diff --git a/yml/OtherMSBinaries/vstest.yaml b/yml/OtherMSBinaries/vstest.console.yml similarity index 96% rename from yml/OtherMSBinaries/vstest.yaml rename to yml/OtherMSBinaries/vstest.console.yml index 15c5a50..aa950be 100644 --- a/yml/OtherMSBinaries/vstest.yaml +++ b/yml/OtherMSBinaries/vstest.console.yml @@ -2,7 +2,7 @@ Name: vstest.console.exe Description: VSTest.Console.exe is the command-line tool to run tests Author: Onat Uzunyayla -Created: 2023-09-08 +Created: 2023-09-08 Commands: - Command: vstest.console.exe testcode.dll Description: VSTest functionality may allow an adversary to executes their malware by wrapping it as a test method then build it to a .exe or .dll file to be later run by vstest.console.exe. This may both allow AWL bypass or defense bypass in general @@ -22,4 +22,4 @@ Resources: - Link: https://learn.microsoft.com/en-us/visualstudio/test/vstest-console-options?view=vs-2022 Acknowledgement: - Person: Onat Uzunyayla - - Person: Ayberk Halac \ No newline at end of file + - Person: Ayberk Halac