public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-26 14:59:03 +01:00
Code Issues Projects Releases Wiki Activity

Merge pull request #27 from sbruno/master

Browse Source 
Fixing yml for ie4uinit binary (was misspelled ie4unit)
This commit is contained in:
Conor Richard 2019-01-23 22:19:05 -05:00 committed by GitHub
commit 7d0cbd553f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
yml/OSBinaries/Ie4unit.yml → yml/OSBinaries/Ie4uinit.yml
View File

@ -1,10 +1,10 @@
---
Name: Ie4unit.exe
Name: Ie4uinit.exe
Description:
Author: 'Oddvar Moe'
Created: '2018-05-25'
Commands:
- Command: ie4unit.exe -BaseSettings
- Command: ie4uinit.exe -BaseSettings
Description: Executes commands from a specially prepared ie4uinit.inf file.
Usecase: Get code execution by copy files to another location
Category: Execute
@ -13,14 +13,14 @@ Commands:
MitreLink: https://attack.mitre.org/wiki/Technique/T1218
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Full_Path:
- Path: c:\windows\system32\ie4unit.exe
- Path: c:\windows\sysWOW64\ie4unit.exe
- Path: c:\windows\system32\ie4uinit.exe
- Path: c:\windows\sysWOW64\ie4uinit.exe
- Path: c:\windows\system32\ieuinit.inf
- Path: c:\windows\sysWOW64\ieuinit.inf
Code_Sample:
- Code:
Detection:
- IOC: ie4unit.exe loading a inf file from outside %windir%
- IOC: ie4uinit.exe loading a inf file from outside %windir%
Resources:
- Link: https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/
Acknowledgement: