From ada7f7f6c3f3e3bda1910a9158b24f6c9022082b Mon Sep 17 00:00:00 2001 From: Andrew Kisliakov Date: Mon, 17 Jan 2022 08:11:47 +0000 Subject: [PATCH 1/5] Microsoft Teams as a LOLbin --- yml/OtherMSBinaries/Teams.yml | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 yml/OtherMSBinaries/Teams.yml diff --git a/yml/OtherMSBinaries/Teams.yml b/yml/OtherMSBinaries/Teams.yml new file mode 100644 index 0000000..1a05057 --- /dev/null +++ b/yml/OtherMSBinaries/Teams.yml @@ -0,0 +1,31 @@ +--- +Name: Teams.exe +Description: Electron runtime binary which runs the Teams application +Author: Andrew Kisliakov +Created: 2022-01-17 +Commands: + - Command: Teams.exe + Description: Generate JavaScript payload and package.json, and save to %LOCALAPPDATA%\Microsoft\Teams\current\app\ before executing. + Usecase: Execute JavaScript code + Category: Execute + Privileges: User + MitreID: T1218 + OperatingSystem: Windows 7 and up with Microsoft Teams installed + - Command: Teams.exe + Description: Generate JavaScript payload and package.json, archive in ASAR file and save to %LOCALAPPDATA%\Microsoft\Teams\current\app.asar before executing. + Usecase: Execute JavaScript code + Category: Execute + Privileges: User + MitreID: T1218 + OperatingSystem: Windows 7 and up with Microsoft Teams installed +Full_Path: + - Path: %LOCALAPPDATA%\Microsoft\Teams\current\Teams.exe +Code_Sample: + - Code: https://github.com/lltltk/LOLBAS-research/tree/master/Teams +Detection: + - IOC: %LOCALAPPDATA%\Microsoft\Teams\current\app directory created + - IOC: %LOCALAPPDATA%\Microsoft\Teams\current\app.asar file created/modified by non-Teams installer/updater +Resources: + - Link: https://l--k.uk/2022/01/16/microsoft-teams-and-other-electron-apps-as-lolbins/ +Acknowledgement: + - Person: Andrew Kisliakov From 03c148682aebb0eeca3fafcace93b49f65d90d2c Mon Sep 17 00:00:00 2001 From: Wietze Date: Sat, 5 Aug 2023 19:15:24 +0100 Subject: [PATCH 2/5] Minor change to trigger CI checks --- yml/OtherMSBinaries/Teams.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/yml/OtherMSBinaries/Teams.yml b/yml/OtherMSBinaries/Teams.yml index 1a05057..0118779 100644 --- a/yml/OtherMSBinaries/Teams.yml +++ b/yml/OtherMSBinaries/Teams.yml @@ -10,14 +10,14 @@ Commands: Category: Execute Privileges: User MitreID: T1218 - OperatingSystem: Windows 7 and up with Microsoft Teams installed + OperatingSystem: Windows - Command: Teams.exe Description: Generate JavaScript payload and package.json, archive in ASAR file and save to %LOCALAPPDATA%\Microsoft\Teams\current\app.asar before executing. Usecase: Execute JavaScript code Category: Execute Privileges: User MitreID: T1218 - OperatingSystem: Windows 7 and up with Microsoft Teams installed + OperatingSystem: Windows Full_Path: - Path: %LOCALAPPDATA%\Microsoft\Teams\current\Teams.exe Code_Sample: From a6783069354185dfe08ab575712027eeff8c93d9 Mon Sep 17 00:00:00 2001 From: josehelps Date: Sun, 3 Sep 2023 14:43:08 -0400 Subject: [PATCH 3/5] bug: CI failing fixing --- yml/OtherMSBinaries/Teams.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yml/OtherMSBinaries/Teams.yml b/yml/OtherMSBinaries/Teams.yml index 0118779..317be06 100644 --- a/yml/OtherMSBinaries/Teams.yml +++ b/yml/OtherMSBinaries/Teams.yml @@ -19,12 +19,12 @@ Commands: MitreID: T1218 OperatingSystem: Windows Full_Path: - - Path: %LOCALAPPDATA%\Microsoft\Teams\current\Teams.exe + - Path: "%LOCALAPPDATA%\Microsoft\Teams\current\Teams.exe" Code_Sample: - Code: https://github.com/lltltk/LOLBAS-research/tree/master/Teams Detection: - - IOC: %LOCALAPPDATA%\Microsoft\Teams\current\app directory created - - IOC: %LOCALAPPDATA%\Microsoft\Teams\current\app.asar file created/modified by non-Teams installer/updater + - IOC: "%LOCALAPPDATA%\Microsoft\Teams\current\app directory created" + - IOC: "%LOCALAPPDATA%\Microsoft\Teams\current\app.asar file created/modified by non-Teams installer/updater" Resources: - Link: https://l--k.uk/2022/01/16/microsoft-teams-and-other-electron-apps-as-lolbins/ Acknowledgement: From e935a7bf0577ae2bcb73462407af538c57be3aa0 Mon Sep 17 00:00:00 2001 From: josehelps Date: Sun, 3 Sep 2023 14:47:48 -0400 Subject: [PATCH 4/5] still trying to correct CI fails --- yml/OtherMSBinaries/Teams.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/yml/OtherMSBinaries/Teams.yml b/yml/OtherMSBinaries/Teams.yml index 317be06..146bc80 100644 --- a/yml/OtherMSBinaries/Teams.yml +++ b/yml/OtherMSBinaries/Teams.yml @@ -5,27 +5,28 @@ Author: Andrew Kisliakov Created: 2022-01-17 Commands: - Command: Teams.exe - Description: Generate JavaScript payload and package.json, and save to %LOCALAPPDATA%\Microsoft\Teams\current\app\ before executing. + Description: Generate JavaScript payload and package.json, and save to "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app\\" before executing. Usecase: Execute JavaScript code Category: Execute Privileges: User MitreID: T1218 OperatingSystem: Windows - Command: Teams.exe - Description: Generate JavaScript payload and package.json, archive in ASAR file and save to %LOCALAPPDATA%\Microsoft\Teams\current\app.asar before executing. + Description: Generate JavaScript payload and package.json, archive in ASAR file and save to "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app.asar" before executing. Usecase: Execute JavaScript code Category: Execute Privileges: User MitreID: T1218 OperatingSystem: Windows Full_Path: - - Path: "%LOCALAPPDATA%\Microsoft\Teams\current\Teams.exe" + - Path: "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\Teams.exe" Code_Sample: - Code: https://github.com/lltltk/LOLBAS-research/tree/master/Teams Detection: - - IOC: "%LOCALAPPDATA%\Microsoft\Teams\current\app directory created" - - IOC: "%LOCALAPPDATA%\Microsoft\Teams\current\app.asar file created/modified by non-Teams installer/updater" + - IOC: "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app directory created" + - IOC: "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app.asar file created/modified by non-Teams installer/updater" Resources: - Link: https://l--k.uk/2022/01/16/microsoft-teams-and-other-electron-apps-as-lolbins/ Acknowledgement: - Person: Andrew Kisliakov + From 26cc0852431054a0a14665ff1312dae249a75e43 Mon Sep 17 00:00:00 2001 From: josehelps Date: Sun, 3 Sep 2023 14:49:16 -0400 Subject: [PATCH 5/5] removing blank line --- yml/OtherMSBinaries/Teams.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/yml/OtherMSBinaries/Teams.yml b/yml/OtherMSBinaries/Teams.yml index 146bc80..4ff119a 100644 --- a/yml/OtherMSBinaries/Teams.yml +++ b/yml/OtherMSBinaries/Teams.yml @@ -29,4 +29,3 @@ Resources: - Link: https://l--k.uk/2022/01/16/microsoft-teams-and-other-electron-apps-as-lolbins/ Acknowledgement: - Person: Andrew Kisliakov -