mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2025-07-26 04:04:09 +02:00
Fixing yml files with .yaml extension (#338)
This commit is contained in:
@@ -1,24 +0,0 @@
|
||||
---
|
||||
Name: vstest.console.exe
|
||||
Description: VSTest.Console.exe is the command-line tool to run tests
|
||||
Author: Onat Uzunyayla
|
||||
Created: 2023-09-08
|
||||
Commands:
|
||||
- Command: vstest.console.exe testcode.dll
|
||||
Description: Executes the test methods inside the crafted dll file
|
||||
Usecase: Proxy Execution, Adversaries may run malicious code embedded inside the test methods of crafted dll/exe
|
||||
Category: AWL Bypass
|
||||
Privileges: User
|
||||
MitreID: T1127
|
||||
OperatingSystem: Windows 10, Windows 11
|
||||
Full_Path:
|
||||
- Path: C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe
|
||||
- Path: C:\Program Files (x86)\Microsoft Visual Studio\2022\TestAgent\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe
|
||||
Code_Sample:
|
||||
- Code: https://github.com/onatuzunyayla/vstest-lolbin-example/
|
||||
Detection:
|
||||
- IOC: vstest.console.exe spawning unexpected processes
|
||||
Resources:
|
||||
- Link: https://learn.microsoft.com/en-us/visualstudio/test/vstest-console-options?view=vs-2022
|
||||
Acknowledgement:
|
||||
- Person: Ayberk Halac
|
@@ -2,7 +2,7 @@
|
||||
Name: vstest.console.exe
|
||||
Description: VSTest.Console.exe is the command-line tool to run tests
|
||||
Author: Onat Uzunyayla
|
||||
Created: 2023-09-08
|
||||
Created: 2023-09-08
|
||||
Commands:
|
||||
- Command: vstest.console.exe testcode.dll
|
||||
Description: VSTest functionality may allow an adversary to executes their malware by wrapping it as a test method then build it to a .exe or .dll file to be later run by vstest.console.exe. This may both allow AWL bypass or defense bypass in general
|
||||
@@ -22,4 +22,4 @@ Resources:
|
||||
- Link: https://learn.microsoft.com/en-us/visualstudio/test/vstest-console-options?view=vs-2022
|
||||
Acknowledgement:
|
||||
- Person: Onat Uzunyayla
|
||||
- Person: Ayberk Halac
|
||||
- Person: Ayberk Halac
|
Reference in New Issue
Block a user