mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2024-12-26 14:59:03 +01:00
Errors in YAML files corrected
This commit is contained in:
parent
550263cd1e
commit
a61d2586cf
@ -15,15 +15,7 @@ Commands:
|
|||||||
- Command: Microsoft.Worflow.Compiler.exe tests.txt results.txt
|
- Command: Microsoft.Worflow.Compiler.exe tests.txt results.txt
|
||||||
Description: Compile and execute C# or VB.net code in a XOML file referenced in the test.txt file.
|
Description: Compile and execute C# or VB.net code in a XOML file referenced in the test.txt file.
|
||||||
Usecase: Compile and run code
|
Usecase: Compile and run code
|
||||||
Category: Execution
|
Category: Execute
|
||||||
Privileges: User
|
|
||||||
MitreID: T1127
|
|
||||||
MitreLink: https://attack.mitre.org/wiki/Technique/T1127
|
|
||||||
OperatingSystem: Windows 10S
|
|
||||||
- Command: Microsoft.Worflow.Compiler.exe tests.xml results.xml
|
|
||||||
Description: Compile and execute C# or VB.net code in a XOML file referenced in the test.xml file.
|
|
||||||
Usecase: Compile and run code
|
|
||||||
Category: AWL Bypass
|
|
||||||
Privileges: User
|
Privileges: User
|
||||||
MitreID: T1127
|
MitreID: T1127
|
||||||
MitreLink: https://attack.mitre.org/wiki/Technique/T1127
|
MitreLink: https://attack.mitre.org/wiki/Technique/T1127
|
||||||
|
@ -1,22 +1,27 @@
|
|||||||
---
|
---
|
||||||
Name: Schtasks.exe
|
Name: Schtasks.exe
|
||||||
Description: Schedule periodic tasks
|
Description: Schedule periodic tasks
|
||||||
Author: 'Ossi Vaananen'
|
Author: 'Oddvar Moe'
|
||||||
Created: '2018-10-24'
|
Created: '2018-05-25'
|
||||||
Commands:
|
Commands:
|
||||||
- Command: schtasks /create /sc minute /mo 1 /tn "Reverse shell" /tr c:\some\directory\revshell.exe
|
- Command: schtasks /create /sc minute /mo 1 /tn "Reverse shell" /tr c:\some\directory\revshell.exe
|
||||||
Description: Create a recurring task to execute every minute.
|
Description: Create a recurring task to execute every minute.
|
||||||
Usecase: Create a recurring task, to eg. to keep reverse shell session(s) alive
|
Usecase: Create a recurring task, to eg. to keep reverse shell session(s) alive
|
||||||
Category: Persistence
|
Category: Persistence
|
||||||
Privileges: User
|
Privileges: User
|
||||||
|
MitreID: T1053
|
||||||
|
MitreLink: https://attack.mitre.org/wiki/Technique/T1053
|
||||||
OperatingSystem: Windows
|
OperatingSystem: Windows
|
||||||
Full Path:
|
Full Path:
|
||||||
- Path: c:\windows\system32\schtasks.exe
|
- Path: c:\windows\system32\schtasks.exe
|
||||||
|
- Path: c:\windows\syswow64\schtasks.exe
|
||||||
Code Sample:
|
Code Sample:
|
||||||
- Code:
|
- Code:
|
||||||
|
Detection:
|
||||||
|
- IOC: Services that gets created
|
||||||
Resources:
|
Resources:
|
||||||
- Link: https://isc.sans.edu/forums/diary/Adding+Persistence+Via+Scheduled+Tasks/23633/
|
- Link: https://isc.sans.edu/forums/diary/Adding+Persistence+Via+Scheduled+Tasks/23633/
|
||||||
Acknowledgement:
|
Acknowledgement:
|
||||||
- Person: Ossi Vaananen
|
- Person:
|
||||||
Handle:
|
Handle:
|
||||||
---
|
---
|
Loading…
Reference in New Issue
Block a user