From 81688557d0aed1d6444796ff311328932356648d Mon Sep 17 00:00:00 2001 From: Conor Richard Date: Fri, 6 Oct 2023 21:58:12 -0400 Subject: [PATCH] Update Mofcomp.yml Correcting YAML errors --- yml/OSBinaries/Mofcomp.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/yml/OSBinaries/Mofcomp.yml b/yml/OSBinaries/Mofcomp.yml index d8d510a..dfa7e04 100644 --- a/yml/OSBinaries/Mofcomp.yml +++ b/yml/OSBinaries/Mofcomp.yml @@ -9,9 +9,8 @@ Commands: Usecase: Threat actors can use mofcomp.exe to decompile a BMOF binary and then register a malicious class in the WMI repository Category: Execution and Persistence Privileges: User - MitreID: T1047 + MitreID: T1047 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11 & Windows Server 2008 and above -Commands: - Command: mofcomp.exe C:\Programdata\x.mof Description: Abuse of mofcomp.exe to parse a file which contains MOF statements in order create new classes as part of the WMI repository Usecase: Threat actors can use mofcomp.exe to decompile a BMOF binary and then register a malicious class in the WMI repository