From 26a15f55cf5328c4422bcaacc327b1f6c0a65270 Mon Sep 17 00:00:00 2001 From: Elliot Killick Date: Mon, 16 Aug 2021 19:46:47 -0400 Subject: [PATCH 1/2] Create OfflineScannerShell.yml --- yml/OSBinaries/OfflineScannerShell.yml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 yml/OSBinaries/OfflineScannerShell.yml diff --git a/yml/OSBinaries/OfflineScannerShell.yml b/yml/OSBinaries/OfflineScannerShell.yml new file mode 100644 index 0000000..4487102 --- /dev/null +++ b/yml/OSBinaries/OfflineScannerShell.yml @@ -0,0 +1,22 @@ +--- +Name: OfflineScannerShell.exe +Description: Windows Defender Offline Shell +Author: 'Elliot Killick' +Created: '2021-08-16' +Commands: + - Command: OfflineScannerShell.exe + Description: Execute mpclient.dll library in the current directory + Usecase: Can be used to evade defensive countermeasures or to hide as a persistence mechanism + Category: Execute + Privileges: Administrator + MitreID: T1218 + MitreLink: https://attack.mitre.org/wiki/Technique/T1218/ + OperatingSystem: Windows 10 +Full_Path: + - Path: C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe +Detection: + - IOC: OfflineScannerShell.exe should not be run on a normal workstation +Acknowledgement: + - Person: Elliot Killick + Handle: '@elliotkillick' +--- From 084fb8398400b121df71b719e2faea62011aadb2 Mon Sep 17 00:00:00 2001 From: Elliot Killick Date: Thu, 26 Aug 2021 12:07:04 -0400 Subject: [PATCH 2/2] Remove .exe from command and increase specificity --- yml/OSBinaries/OfflineScannerShell.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/yml/OSBinaries/OfflineScannerShell.yml b/yml/OSBinaries/OfflineScannerShell.yml index 4487102..3bc27b0 100644 --- a/yml/OSBinaries/OfflineScannerShell.yml +++ b/yml/OSBinaries/OfflineScannerShell.yml @@ -4,8 +4,8 @@ Description: Windows Defender Offline Shell Author: 'Elliot Killick' Created: '2021-08-16' Commands: - - Command: OfflineScannerShell.exe - Description: Execute mpclient.dll library in the current directory + - Command: OfflineScannerShell + Description: Execute mpclient.dll library in the current working directory Usecase: Can be used to evade defensive countermeasures or to hide as a persistence mechanism Category: Execute Privileges: Administrator