From b330d431164bd515009a68b75b109dbd0e58f906 Mon Sep 17 00:00:00 2001 From: bohops Date: Sun, 23 Sep 2018 22:23:04 -0400 Subject: [PATCH] Changed to latest template --- yml/OSLibraries/Advpack.yml | 95 ++++++++++++++++++++---------- yml/OSLibraries/Ieadvpack.yml | 90 +++++++++++++++++++--------- yml/OSLibraries/Ieframe.yml | 52 +++++++++------- yml/OSLibraries/Mshtml.yml | 43 ++++++++------ yml/OSLibraries/Pcwutl.yml | 43 ++++++++------ yml/OSLibraries/Setupapi.yml | 69 ++++++++++++++-------- yml/OSLibraries/Shdocvw.yml | 52 +++++++++------- yml/OSLibraries/Shell32.yml | 72 +++++++++++++++-------- yml/OSLibraries/Syssetup.yml | 66 +++++++++++++-------- yml/OSLibraries/Url.yml | 108 +++++++++++++++++++++++----------- yml/OSLibraries/Zipfldr.yml | 57 +++++++++++------- 11 files changed, 485 insertions(+), 262 deletions(-) diff --git a/yml/OSLibraries/Advpack.yml b/yml/OSLibraries/Advpack.yml index 25106bd..36cdd06 100644 --- a/yml/OSLibraries/Advpack.yml +++ b/yml/OSLibraries/Advpack.yml @@ -1,30 +1,65 @@ ---- -Name: Advpack.dll -Description: Execute -Author: '' -Created: '2018-05-25' -Categories: [] -Commands: - - Command: rundll32.exe advpack.dll,LaunchINFSection c:\\test.inf,DefaultInstall_SingleUser,1, - Description: Remote fetch and execute a COM Scriptlet by calling an information file directive (Section name specified). - - Command: rundll32.exe advpack.dll,LaunchINFSection test.inf,,1, - Description: Remote fetch and execute a COM Scriptlet by calling an information file directive (DefaultInstall section implied). - - Command: rundll32.exe Advpack.dll,RegisterOCX calc.exe - Description: Launch executable by calling the RegisterOCX function. - - Command: rundll32 advpack.dll, RegisterOCX "cmd.exe /c calc.exe" - Description: Launch executable by calling the RegisterOCX function. - - Command: rundll32.exe Advpack.dll,RegisterOCX test.dll - Description: Launch a DLL payload by calling the RegisterOCX function. -Full Path: - - c:\windows\system32\advpack.dll - - c:\windows\sysWOW64\advpack.dll -Code Sample: - - https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSLibraries/Payload/Advpack.inf - - https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSLibraries/Payload/Advpack_calc.sct -Detection: [] -Resources: - - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ - - https://twitter.com/ItsReallyNick/status/967859147977850880 - - https://twitter.com/bohops/status/974497123101179904 - - https://twitter.com/moriarty_meng/status/977848311603380224 -Notes: Thanks to Jimmy - @bohops (LaunchINFSection), fabrizio - @0rbz_ (RegisterOCX - DLL), Moriarty @moriarty_meng (RegisterOCX - Cmd) +--- +Name: Advpack.dll +Description: Utility for installing software and drivers with rundll32.exe +Author: '' +Created: '2018-05-25' +Commands: + - Command: rundll32.exe advpack.dll,LaunchINFSection c:\test.inf,DefaultInstall_SingleUser,1, + Description: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified). + Usecase: Run local or remote script(let) code through INF file specification. + Category: AWL Bypass + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows + - Command: rundll32.exe advpack.dll,LaunchINFSection c:\test.inf,,1, + Description: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (DefaultInstall section implied). + Usecase: Run local or remote script(let) code through INF file specification. + Category: AWL Bypass + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows + - Command: rundll32.exe advpack.dll,RegisterOCX test.dll + Description: Launch a DLL payload by calling the RegisterOCX function. + Usecase: Load a DLL payload. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows + - Command: rundll32.exe advpack.dll,RegisterOCX calc.exe + Description: Launch an executable by calling the RegisterOCX function. + Usecase: Run an executable payload. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + - Command: rundll32 advpack.dll, RegisterOCX "cmd.exe /c calc.exe" + Description: Launch command line by calling the RegisterOCX function. + Usecase: Run an executable payload. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 +Full Path: + - path: c:\windows\system32\advpack.dll + - path: c:\windows\syswow64\advpack.dll +Code Sample: + - https://github.com/LOLBAS-Project/LOLBAS-Project.github.io/blob/master/_lolbas/Libraries/Payload/Advpack.inf + - https://github.com/LOLBAS-Project/LOLBAS-Project.github.io/blob/master/_lolbas/Libraries/Payload/Advpack_calc.sct +Detection: [] +Resources: + - resource: https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ + - resource: https://twitter.com/ItsReallyNick/status/967859147977850880 + - resource: https://twitter.com/bohops/status/974497123101179904 + - resource: https://twitter.com/moriarty_meng/status/977848311603380224 +Acknowledgment: + - Person: Jimmy (LaunchINFSection) + Handle: '@bohops' + - Person: Fabrizio (RegisterOCX - DLL) + Handle: '@0rbz_' + - Person: Moriarty (RegisterOCX - CMD) + Handle: '@moriarty_meng' + - Person: Nick Carr (Threat Intel) + Handle: @ItsReallyNick \ No newline at end of file diff --git a/yml/OSLibraries/Ieadvpack.yml b/yml/OSLibraries/Ieadvpack.yml index 044af4b..0559ae2 100644 --- a/yml/OSLibraries/Ieadvpack.yml +++ b/yml/OSLibraries/Ieadvpack.yml @@ -1,28 +1,62 @@ ---- -Name: Ieadvpack.dll -Description: Execute -Author: '' -Created: '2018-05-25' -Categories: [] -Commands: - - Command: rundll32.exe IEAdvpack.dll,LaunchINFSection c:\\test.inf,DefaultInstall_SingleUser,1, - Description: Remote fetch and execute a COM Scriptlet by calling an information file directive (Section name specified). - - Command: rundll32.exe IEAdvpack.dll,LaunchINFSection test.inf,,1, - Description: Remote fetch and execute a COM Scriptlet by calling an information file directive (DefaultInstall section implied). - - Command: rundll32.exe IEAdvpack.dll,RegisterOCX calc.exe - Description: Launch executable by calling the RegisterOCX function. - - Command: rundll32.exe IEAdvpack.dll,RegisterOCX test.dll - Description: Launch a DLL payload by calling the RegisterOCX function. -Full Path: - - c:\windows\system32\ieadvpack.dll - - c:\windows\sysWOW64\ieadvpack.dll -Code Sample: - - https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSLibraries/Payload/Advpack.inf - - https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSLibraries/Payload/Advpack_calc.sct -Detection: [] -Resources: - - https://twitter.com/pabraeken/status/991695411902599168 - - https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/ - - https://twitter.com/0rbz_/status/974472392012689408 -Notes: Thanks to Pierre-Alexandre Braeken - @pabraeken (RegisterOCX - Cmd), Jimmy - @bohops (LaunchINFSection), fabrizio - @0rbz_ (RegisterOCX - DLL) - +--- +Name: Ieadvpack.dll +Description: INF installer for Internet Explorer. Has much of the same functionality as advpack.dll. +Author: '' +Created: '2018-05-25' +Commands: + - Command: rundll32.exe ieadvpack.dll,LaunchINFSection c:\test.inf,DefaultInstall_SingleUser,1, + Description: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified). + Usecase: Run local or remote script(let) code through INF file specification. + Category: AWL Bypass + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows + - Command: rundll32.exe ieadvpack.dll,LaunchINFSection c:\test.inf,,1, + Description: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (DefaultInstall section implied). + Usecase: Run local or remote script(let) code through INF file specification. + Category: AWL Bypass + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows + - Command: rundll32.exe ieadvpack.dll,RegisterOCX test.dll + Description: Launch a DLL payload by calling the RegisterOCX function. + Usecase: Load a DLL payload. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows + - Command: rundll32.exe ieadvpack.dll,RegisterOCX calc.exe + Description: Launch an executable by calling the RegisterOCX function. + Usecase: Run an executable payload. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + - Command: rundll32 ieadvpack.dll, RegisterOCX "cmd.exe /c calc.exe" + Description: Launch command line by calling the RegisterOCX function. + Usecase: Run an executable payload. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 +Full Path: + - path: c:\windows\system32\ieadvpack.dll + - path: c:\windows\syswow64\ieadvpack.dll +Code Sample: + - https://github.com/LOLBAS-Project/LOLBAS-Project.github.io/blob/master/_lolbas/Libraries/Payload/Ieadvpack.inf + - https://github.com/LOLBAS-Project/LOLBAS-Project.github.io/blob/master/_lolbas/Libraries/Payload/Ieadvpack_calc.sct +Detection: [] +Resources: + - resource: https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/ + - resource: https://twitter.com/pabraeken/status/991695411902599168 + - resource: https://twitter.com/0rbz_/status/974472392012689408 +Acknowledgment: + - Person: Jimmy (LaunchINFSection) + Handle: '@bohops' + - Person: Fabrizio (RegisterOCX - DLL) + Handle: '@0rbz_' + - Person: Pierre-Alexandre Braeken (RegisterOCX - CMD) + Handle: '@pabraeken' \ No newline at end of file diff --git a/yml/OSLibraries/Ieframe.yml b/yml/OSLibraries/Ieframe.yml index ab7eb56..da1b580 100644 --- a/yml/OSLibraries/Ieframe.yml +++ b/yml/OSLibraries/Ieframe.yml @@ -1,22 +1,30 @@ ---- -Name: Ieframe.dll -Description: Execute -Author: '' -Created: '2018-05-25' -Categories: [] -Commands: - - Command: rundll32.exe ieframe.dll,OpenURL "C:\test\calc.url" - Description: Launch an executable payload via proxy through a(n) URL (information) file by calling OpenURL. - - Command: rundll32.exe ieframe.dll,OpenURL c:\\test\\calc-url-file.zz - Description: Renamed URL file. -Full Path: - - c:\windows\system32\Ieframe.dll - - c:\windows\sysWOW64\Ieframe.dll -Code Sample: - - https://gist.githubusercontent.com/bohops/89d7b11fa32062cfe31be9fdb18f050e/raw/1206a613a6621da21e7fd164b80a7ff01c5b64ab/calc.url -Detection: [] -Resources: - - http://www.hexacorn.com/blog/2018/03/15/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-5/ - - https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/ - - https://twitter.com/bohops/status/997690405092290561 -Notes: Thanks to Adam - @hexacorn, Jimmy - @bohops +--- +Name: Ieaframe.dll +Description: Internet Browser DLL for translating HTML code. +Author: '' +Created: '2018-05-25' +Commands: + - Command: rundll32.exe ieframe.dll,OpenURL "C:\test\calc.url" + Description: Launch an executable payload via proxy through a(n) URL (information) file by calling OpenURL. + Usecase: Load an executable payload by calling a .url file with or without quotes. The .url file extension can be renamed. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows +Full Path: + - path: c:\windows\system32\ieframe.dll + - path: c:\windows\syswow64\ieframe.dll +Code Sample: + - https://gist.githubusercontent.com/bohops/89d7b11fa32062cfe31be9fdb18f050e/raw/1206a613a6621da21e7fd164b80a7ff01c5b64ab/calc.url +Detection: [] +Resources: + - resource: http://www.hexacorn.com/blog/2018/03/15/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-5/ + - resource: https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/ + - resource: https://twitter.com/bohops/status/997690405092290561 + - resource: https://windows10dll.nirsoft.net/ieframe_dll.html +Acknowledgment: + - Person: Jimmy + Handle: '@bohops' + - Person: Adam + Handle: '@hexacorn' diff --git a/yml/OSLibraries/Mshtml.yml b/yml/OSLibraries/Mshtml.yml index cf87275..1410469 100644 --- a/yml/OSLibraries/Mshtml.yml +++ b/yml/OSLibraries/Mshtml.yml @@ -1,17 +1,26 @@ ---- -Name: Mshtml.dll -Description: Execute -Author: '' -Created: '2018-05-25' -Categories: [] -Commands: - - Command: rundll32.exe Mshtml.dll,PrintHTML "C:\temp\calc.hta" - Description: Invoke an HTML Application. Note - Pops a security warning and a print dialogue box. -Full Path: - - c:\windows\system32\Mshtml.dll - - c:\windows\sysWOW64\Mshtml.dll -Code Sample: [] -Detection: [] -Resources: - - https://twitter.com/pabraeken/status/998567549670477824 -Notes: Thanks to Pierre-Alexandre Braeken - @pabraeken +--- +Name: Mshtml.dll +Description: Microsoft HTML Viewer +Author: '' +Created: '2018-05-25' +Commands: + - Command: rundll32.exe Mshtml.dll,PrintHTML "C:\temp\calc.hta" + Description: Invoke an HTML Application via mshta.exe (Note - Pops a security warning and a print dialogue box). + Usecase: Launch an HTA application. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows +Full Path: + - path: c:\windows\system32\mshtml.dll + - path: c:\windows\syswow64\mshtml.dll +Code Sample: + - '' +Detection: [] +Resources: + - resource: https://twitter.com/pabraeken/status/998567549670477824 + - resource: https://windows10dll.nirsoft.net/mshtml_dll.html +Acknowledgment: + - Person: Pierre-Alexandre Braeken + Handle: '@pabraeken' \ No newline at end of file diff --git a/yml/OSLibraries/Pcwutl.yml b/yml/OSLibraries/Pcwutl.yml index 15e4887..2577154 100644 --- a/yml/OSLibraries/Pcwutl.yml +++ b/yml/OSLibraries/Pcwutl.yml @@ -1,17 +1,26 @@ ---- -Name: Pcwutl.dll -Description: Execute -Author: '' -Created: '2018-05-25' -Categories: [] -Commands: - - Command: rundll32.exe pcwutl.dll,LaunchApplication calc.exe - Description: Launch executable by calling the LaunchApplication function. -Full Path: - - c:\windows\system32\Pcwutl.dll - - c:\windows\sysWOW64\Pcwutl.dll -Code Sample: [] -Detection: [] -Resources: - - https://twitter.com/harr0ey/status/989617817849876488 -Notes: Thanks to Matt harr0ey - @harr0ey +--- +Name: Pcwutl.dll +Description: Microsoft HTML Viewer +Author: '' +Created: '2018-05-25' +Commands: + - Command: rundll32.exe pcwutl.dll,LaunchApplication calc.exe + Description: Launch executable by calling the LaunchApplication function. + Usecase: Launch an executable. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows +Full Path: + - path: c:\windows\system32\pcwutl.dll + - path: c:\windows\syswow64\pcwutl.dll +Code Sample: + - '' +Detection: [] +Resources: + - resource: https://twitter.com/harr0ey/status/989617817849876488 + - resource: https://windows10dll.nirsoft.net/pcwutl_dll.html +Acknowledgment: + - Person: Matt harr0ey + Handle: '@harr0ey' \ No newline at end of file diff --git a/yml/OSLibraries/Setupapi.yml b/yml/OSLibraries/Setupapi.yml index 626fb42..fb7b038 100644 --- a/yml/OSLibraries/Setupapi.yml +++ b/yml/OSLibraries/Setupapi.yml @@ -1,25 +1,44 @@ ---- -Name: Setupapi.dll -Description: Execute -Author: '' -Created: '2018-05-25' -Categories: [] -Commands: - - Command: rundll32 setupapi,InstallHinfSection DefaultInstall 132 c:\temp\calc.inf - Description: Launch an executable file via the InstallHinfSection function and .inf file section directive. - - Command: rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\\Tools\\shady.inf - Description: Remote fetch and execute a COM Scriptlet by calling an information file directive. -Full Path: - - c:\windows\system32\Setupapi.dll - - c:\windows\sysWOW64\Setupapi.dll -Code Sample: - - https://raw.githubusercontent.com/huntresslabs/evading-autoruns/master/shady.inf - - https://gist.github.com/enigma0x3/469d82d1b7ecaf84f4fb9e6c392d25ba#file-backdoor-minimalist-sct - - https://gist.githubusercontent.com/bohops/0cc6586f205f3691e04a1ebf1806aabd/raw/baf7b29891bb91e76198e30889fbf7d6642e8974/calc_exe.inf -Detection: [] -Resources: - - https://twitter.com/pabraeken/status/994742106852941825 - - https://twitter.com/subTee/status/951115319040356352 - - https://twitter.com/KyleHanslovan/status/911997635455852544 - - https://github.com/huntresslabs/evading-autoruns -Notes: Thanks to Pierre-Alexandre Braeken - @pabraeken (Executable), Kyle Hanslovan - @KyleHanslovan (COM Scriptlet), Huntress Labs - @HuntressLabs (COM Scriptlet), Casey Smith - @subTee (COM Scriptlet) +--- +Name: Setupapi.dll +Description: Windows Setup Application Programming Interface +Author: '' +Created: '2018-05-25' +Commands: + - Command: rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Tools\shady.inf + Description: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified). + Usecase: Run local or remote script(let) code through INF file specification. + Category: AWL Bypass + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows + - Command: rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\\Tools\\calc_exe.inf + Description: Launch an executable file via the InstallHinfSection function and .inf file section directive. + Usecase: Load an executable payload. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows +Full Path: + - path: c:\windows\system32\setupapi.dll + - path: c:\windows\syswow64\setupapi.dll +Code Sample: + - https://raw.githubusercontent.com/huntresslabs/evading-autoruns/master/shady.inf + - https://gist.github.com/enigma0x3/469d82d1b7ecaf84f4fb9e6c392d25ba#file-backdoor-minimalist-sct + - https://gist.githubusercontent.com/enigma0x3/469d82d1b7ecaf84f4fb9e6c392d25ba/raw/6cb52b88bcc929f5555cd302d9ed848b7e407052/Backdoor-Minimalist.sct + - https://gist.githubusercontent.com/bohops/0cc6586f205f3691e04a1ebf1806aabd/raw/baf7b29891bb91e76198e30889fbf7d6642e8974/calc_exe.inf +Detection: [] +Resources: + - resource: https://github.com/huntresslabs/evading-autoruns + - resource: https://twitter.com/pabraeken/status/994742106852941825 + - resource: https://windows10dll.nirsoft.net/setupapi_dll.html +Acknowledgment: + - Person: Kyle Hanslovan (COM Scriptlet) + Handle: '@KyleHanslovan' + - Person: Huntress Labs (COM Scriptlet) + Handle: '@HuntressLabs' + - Person: Casey Smith (COM Scriptlet) + Handle: '@subTee' + - Person: Nick Carr (Threat Intel) + Handle: @ItsReallyNick \ No newline at end of file diff --git a/yml/OSLibraries/Shdocvw.yml b/yml/OSLibraries/Shdocvw.yml index 33023d7..305983e 100644 --- a/yml/OSLibraries/Shdocvw.yml +++ b/yml/OSLibraries/Shdocvw.yml @@ -1,22 +1,30 @@ ---- -Name: Shdocvw.dll -Description: Execute -Author: '' -Created: '2018-05-25' -Categories: [] -Commands: - - Command: rundll32.exe shdocvw.dll,OpenURL "C:\test\calc.url" - Description: Launch an executable payload via proxy through a(n) URL (information) file by calling OpenURL. - - Command: rundll32.exe shdocvw.dll,OpenURL "C:\test\calc.zz" - Description: Renamed URL file. -Full Path: - - c:\windows\system32\Shdocvw.dll - - c:\windows\sysWOW64\Shdocvw.dll -Code Sample: - - https://gist.githubusercontent.com/bohops/89d7b11fa32062cfe31be9fdb18f050e/raw/1206a613a6621da21e7fd164b80a7ff01c5b64ab/calc.url -Detection: [] -Resources: - - http://www.hexacorn.com/blog/2018/03/15/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-5/ - - https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/ - - https://twitter.com/bohops/status/997690405092290561 -Notes: Thanks to Adam - @hexacorn, Jimmy - @bohops +--- +Name: Shdocvw.dll +Description: Shell Doc Object and Control Library. +Author: '' +Created: '2018-05-25' +Commands: + - Command: rundll32.exe shdocvw.dll,OpenURL "C:\test\calc.url" + Description: Launch an executable payload via proxy through a(n) URL (information) file by calling OpenURL. + Usecase: Load an executable payload by calling a .url file with or without quotes. The .url file extension can be renamed. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows +Full Path: + - path: c:\windows\system32\shdocvw.dll + - path: c:\windows\syswow64\shdocvw.dll +Code Sample: + - https://gist.githubusercontent.com/bohops/89d7b11fa32062cfe31be9fdb18f050e/raw/1206a613a6621da21e7fd164b80a7ff01c5b64ab/calc.url +Detection: [] +Resources: + - resource: http://www.hexacorn.com/blog/2018/03/15/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-5/ + - resource: https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/ + - resource: https://twitter.com/bohops/status/997690405092290561 + - resource: https://windows10dll.nirsoft.net/shdocvw_dll.html +Acknowledgment: + - Person: Adam + Handle: '@hexacorn' + - Person: Jimmy + Handle: '@bohops' diff --git a/yml/OSLibraries/Shell32.yml b/yml/OSLibraries/Shell32.yml index 030887f..ee4c858 100644 --- a/yml/OSLibraries/Shell32.yml +++ b/yml/OSLibraries/Shell32.yml @@ -1,24 +1,48 @@ ---- -Name: Shell32.dll -Description: Execute -Author: '' -Created: '2018-05-25' -Categories: [] -Commands: - - Command: rundll32.exe shell32.dll,Control_RunDLL payload.dll - Description: Launch DLL payload. - - Command: rundll32.exe shell32.dll,ShellExec_RunDLL beacon.exe - Description: Launch executable payload. - - Command: rundll32 SHELL32.DLL,ShellExec_RunDLL "cmd.exe" "/c echo hi" - Description: Launch executable payload with arguments. -Full Path: - - c:\windows\system32\shell32.dll - - c:\windows\sysWOW64\shell32.dll -Code Sample: [] -Detection: [] -Resources: - - https://twitter.com/Hexacorn/status/885258886428725250 - - https://twitter.com/pabraeken/status/991768766898941953 - - https://twitter.com/mattifestation/status/776574940128485376 - - https://twitter.com/KyleHanslovan/status/905189665120149506 -Notes: Thanks to Adam - @hexacorn (Control_RunDLL), Pierre-Alexandre Braeken - @pabraeken (ShellExec_RunDLL), Matt Graeber - @mattifestation (ShellExec_RunDLL), Kyle Hanslovan - @KyleHanslovan (ShellExec_RunDLL) +--- +Name: Shell32.dll +Description: Windows Shell Common Dll +Author: '' +Created: '2018-05-25' +Commands: + - Command: rundll32.exe shell32.dll,Control_RunDLL payload.dll + Description: Launch a DLL payload by calling the Control_RunDLL function. + Usecase: Load a DLL payload. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows + - Command: rundll32.exe shell32.dll,ShellExec_RunDLL beacon.exe + Description: Launch an executable by calling the ShellExec_RunDLL function. + Usecase: Run an executable payload. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + - Command: rundll32 SHELL32.DLL,ShellExec_RunDLL "cmd.exe" "/c echo hi" + Description: Launch command line by calling the ShellExec_RunDLL function. + Usecase: Run an executable payload. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 +Full Path: + - path: c:\windows\system32\shell32.dll + - path: c:\windows\syswow64\shell32.dll +Code Sample: [] +Detection: [] +Resources: + - resource: https://twitter.com/Hexacorn/status/885258886428725250 + - resource: https://twitter.com/pabraeken/status/991768766898941953 + - resource: https://twitter.com/mattifestation/status/776574940128485376 + - resource: https://twitter.com/KyleHanslovan/status/905189665120149506 + - resource: https://windows10dll.nirsoft.net/shell32_dll.html +Acknowledgment: + - Person: Adam (Control_RunDLL) + Handle: '@hexacorn' + - Person: Pierre-Alexandre Braeken (ShellExec_RunDLL) + Handle: '@pabraeken' + - Person: Matt Graeber (ShellExec_RunDLL) + Handle: '@mattifestation' + - Person: Kyle Hanslovan (ShellExec_RunDLL) + Handle: '@KyleHanslovan' \ No newline at end of file diff --git a/yml/OSLibraries/Syssetup.yml b/yml/OSLibraries/Syssetup.yml index 8612289..66e355a 100644 --- a/yml/OSLibraries/Syssetup.yml +++ b/yml/OSLibraries/Syssetup.yml @@ -1,24 +1,42 @@ ---- -Name: Syssetup.dll -Description: Execute -Author: '' -Created: '2018-05-25' -Categories: [] -Commands: - - Command: rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 c:\temp\calc.INF - Description: Launch an executable file via the SetupInfObjectInstallAction function and .inf file section directive. - - Command: rundll32.exe syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 c:\\test\\shady.inf - Description: Remote fetch and execute a COM Scriptlet by calling an information file directive. -Full Path: - - c:\windows\system32\Syssetup.dll - - c:\windows\sysWOW64\Syssetup.dll -Code Sample: - - https://raw.githubusercontent.com/huntresslabs/evading-autoruns/master/shady.inf - - https://gist.github.com/enigma0x3/469d82d1b7ecaf84f4fb9e6c392d25ba#file-backdoor-minimalist-sct - - https://gist.githubusercontent.com/bohops/0cc6586f205f3691e04a1ebf1806aabd/raw/baf7b29891bb91e76198e30889fbf7d6642e8974/calc_exe.inf -Detection: [] -Resources: - - https://twitter.com/pabraeken/status/994392481927258113 - - https://twitter.com/harr0ey/status/975350238184697857 - - https://twitter.com/bohops/status/975549525938135040 -Notes: Thanks to Pierre-Alexandre Braeken - @pabraeken (Execute), Matt harr0ey - @harr0ey (Execute), Jimmy - @bohops (COM Scriptlet) +--- +Name: Syssetup.dll +Description: Windows NT System Setup +Author: '' +Created: '2018-05-25' +Commands: + - Command: rundll32.exe syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 c:\test\shady.inf + Description: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified). + Usecase: Run local or remote script(let) code through INF file specification (Note: May pop an error window). + Category: AWL Bypass + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows + - Command: rundll32 syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 c:\temp\something.inf + Description: Launch an executable file via the SetupInfObjectInstallAction function and .inf file section directive. + Usecase: Load an executable payload. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows +Full Path: + - path: c:\windows\system32\syssetup.dll + - path: c:\windows\syswow64\syssetup.dll +Code Sample: + - https://raw.githubusercontent.com/huntresslabs/evading-autoruns/master/shady.inf + - https://gist.github.com/enigma0x3/469d82d1b7ecaf84f4fb9e6c392d25ba#file-backdoor-minimalist-sct + - https://gist.github.com/homjxi0e/87b29da0d4f504cb675bb1140a931415 +Detection: [] +Resources: + - resource: https://twitter.com/pabraeken/status/994392481927258113 + - resource: https://twitter.com/harr0ey/status/975350238184697857 + - resource: https://twitter.com/bohops/status/975549525938135040 + - resource: https://windows10dll.nirsoft.net/syssetup_dll.html +Acknowledgment: + - Person: Pierre-Alexandre Braeken (Execute) + Handle: '@pabraeken' + - Person: Matt harr0ey (Execute) + Handle: '@harr0ey' + - Person: Jimmy (Scriptlet) + Handle: '@bohops' \ No newline at end of file diff --git a/yml/OSLibraries/Url.yml b/yml/OSLibraries/Url.yml index 0c1221f..ecda3a2 100644 --- a/yml/OSLibraries/Url.yml +++ b/yml/OSLibraries/Url.yml @@ -1,33 +1,75 @@ ---- -Name: Url.dll -Description: Execute -Author: '' -Created: '2018-05-25' -Categories: [] -Commands: - - Command: rundll32.exe url.dll,OpenURL "C:\\test\\calc.hta" - Description: Launch a HTML application payload by calling OpenURL. - - Command: rundll32.exe url.dll,OpenURL "C:\\test\\calc.url" - Description: Launch an executable payload via proxy through a(n) URL (information) file by calling OpenURL. - - Command: rundll32.exe url.dll,OpenURL file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e - Description: Launch an executable payload by calling OpenURL. - - Command: rundll32.exe url.dll,FileProtocolHandler calc.exe - Description: Launch an executable payload by calling FileProtocolHandler. - - Command: rundll32.exe url.dll,FileProtocolHandler file:///C:/test/test.hta - Description: Launch a HTML application payload by calling FileProtocolHandler. - - Command: rundll32 url.dll,FileProtocolHandler file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e - Description: Launch an executable payload by calling FileProtocolHandler. - -Full Path: - - c:\windows\system32\url.dll - - c:\windows\sysWOW64\url.dll -Code Sample: - - https://gist.githubusercontent.com/bohops/89d7b11fa32062cfe31be9fdb18f050e/raw/1206a613a6621da21e7fd164b80a7ff01c5b64ab/calc.url -Detection: [] -Resources: - - https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/ - - https://twitter.com/bohops/status/974043815655956481 - - https://twitter.com/DissectMalware/status/995348436353470465 - - https://twitter.com/yeyint_mth/status/997355558070927360 - - https://twitter.com/Hexacorn/status/974063407321223168 -Notes: Thanks to Jimmy - @bohops (OpenURL), Adam - @hexacorn (OpenURL), Malwrologist - @DissectMalware (FileProtocolHandler - HTA), r0lan - @yeyint_mth (Obfuscation) +--- +Name: Url.dll +Description: Internet Shortcut Shell Extension DLL. +Author: '' +Created: '2018-05-25' +Commands: + - Command: rundll32.exe url.dll,OpenURL "C:\test\calc.hta" + Description: Launch a HTML application payload by calling OpenURL. + Usecase: Invoke an HTML Application via mshta.exe (Default Handler). + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows + - Command: rundll32.exe url.dll,OpenURL "C:\test\calc.url" + Description: Launch an executable payload via proxy through a(n) URL (information) file by calling OpenURL. + Usecase: Load an executable payload by calling a .url file with or without quotes. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows + - Command: rundll32.exe url.dll,OpenURL file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e + Description: Launch an executable by calling OpenURL. + Usecase: Load an executable payload by specifying the file protocol handler (obfuscated). + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows + - Command: rundll32.exe url.dll,FileProtocolHandler calc.exe + Description: Launch an executable by calling FileProtocolHandler. + Usecase: Launch an executable. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows + - Command: rundll32.exe url.dll,FileProtocolHandler file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e + Description: Launch an executable by calling FileProtocolHandler. + Usecase: Load an executable payload by specifying the file protocol handler (obfuscated). + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows + - Command: rundll32.exe url.dll,FileProtocolHandler file:///C:/test/test.hta + Description: Launch a HTML application payload by calling FileProtocolHandler. + Usecase: Invoke an HTML Application via mshta.exe (Default Handler). + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows +Full Path: + - path: c:\windows\system32\url.dll + - path: c:\windows\syswow64\url.dll +Code Sample: [] +Detection: [] +Resources: + - resource: https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/ + - resource: https://twitter.com/DissectMalware/status/995348436353470465 + - resource: https://twitter.com/bohops/status/974043815655956481 + - resource: https://twitter.com/yeyint_mth/status/997355558070927360 + - resource: https://twitter.com/Hexacorn/status/974063407321223168 + - resource: https://windows10dll.nirsoft.net/url_dll.html +Acknowledgment: + - Person: Adam (OpenURL) + Handle: '@hexacorn' + - Person: Jimmy (OpenURL) + Handle: '@bohops' + - Person: Malwrologist (FileProtocolHandler - HTA) + Handle: '@DissectMalware' + - Person: r0lan (Obfuscation) + Handle: '@r0lan' \ No newline at end of file diff --git a/yml/OSLibraries/Zipfldr.yml b/yml/OSLibraries/Zipfldr.yml index 85e6eb9..8a00799 100644 --- a/yml/OSLibraries/Zipfldr.yml +++ b/yml/OSLibraries/Zipfldr.yml @@ -1,20 +1,37 @@ ---- -Name: Zipfldr.dll -Description: Execute -Author: '' -Created: '2018-05-25' -Categories: [] -Commands: - - Command: rundll32.exe zipfldr.dll,RouteTheCall calc.exe - Description: Launch an executable payload by calling RouteTheCall. - - Command: rundll32.exe zipfldr.dll,RouteTheCall file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e - Description: Launch an executable payload by calling RouteTheCall. -Full Path: - - c:\windows\system32\zipfldr.dll - - c:\windows\sysWOW64\zipfldr.dll -Code Sample: [] -Detection: [] -Resources: - - https://twitter.com/moriarty_meng/status/977848311603380224 - - https://twitter.com/bohops/status/997896811904929792 -Notes: Thanks to Moriarty - @moriarty_meng (Execute), r0lan - @yeyint_mth (Obfuscation) +--- +Name: Zipfldr.dll +Description: Compressed Folder library +Author: '' +Created: '2018-05-25' +Commands: + - Command: rundll32.exe zipfldr.dll,RouteTheCall calc.exe + Description: Launch an executable payload by calling RouteTheCall. + Usecase: Launch an executable. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows + - Command: rundll32.exe zipfldr.dll,RouteTheCall file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e + Description: Launch an executable payload by calling RouteTheCall (obfuscated). + Usecase: Launch an executable. + Category: Execution + Privileges: User + MitreID: T1085 + MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + OperatingSystem: Windows +Full Path: + - path: c:\windows\system32\zipfldr.dll + - path: c:\windows\syswow64\zipfldr.dll +Code Sample: + - '' +Detection: [] +Resources: + - resource: https://twitter.com/moriarty_meng/status/977848311603380224 + - resource: https://twitter.com/bohops/status/997896811904929792 + - resource: https://windows10dll.nirsoft.net/zipfldr_dll.html +Acknowledgment: + - Person: Moriarty (Execution) + Handle: '@moriarty_meng' + - Person: r0lan (Obfuscation) + Handle: '@r0lan' \ No newline at end of file