public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-07-27 04:32:24 +02:00
Code Issues Projects Releases Wiki Activity

Several LOLBINs additions & modifications (#192)

Browse Source 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
mrd0x
2023-03-31 08:46:21 -04:00
committed by GitHub
parent a9046ecb85
commit 787c87470e
8 changed files with 102 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
yml/OtherMSBinaries/Createdump.yml
View File

@@ -1,8 +1,8 @@
---
Name: Createdump.exe
Description: Microsoft .NET Runtime Crash Dump Generator (included in .NET Core)
Author: Daniel Santos
Created: 2022-08-05
Author: mr.d0x, Daniel Santos
Created: 2022-01-20
Commands:
- Command: createdump.exe -n -f dump.dmp [PID]
Description: Dump process by PID and create a minidump file. If "-f dump.dmp" is not specified, the file is created as '%TEMP%\dump.%p.dmp' where %p is the PID of the target process.
@@ -13,6 +13,9 @@ Commands:
OperatingSystem: Windows 10, Windows 11
Full_Path:
- Path: C:\Program Files\dotnet\shared\Microsoft.NETCore.App\*\createdump.exe
- Path: C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\*\createdump.exe
- Path: C:\Program Files\Microsoft Visual Studio\*\Community\dotnet\runtime\shared\Microsoft.NETCore.App\6.0.0\createdump.exe
- Path: C:\Program Files (x86)\Microsoft Visual Studio\*\Community\dotnet\runtime\shared\Microsoft.NETCore.App\6.0.0\createdump.exe
Detection:
- Sigma: https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_proc_dump_createdump.yml
- Sigma: https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_susp_renamed_createdump.yml