public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-11-04 02:29:34 +01:00
Code Issues Projects Releases Wiki Activity

Tar.exe lateral movement (#277)

Browse Source 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
CyberSorcery
2023-06-17 16:25:34 -05:00
committed by GitHub
parent 8aca00a56b
commit c3f2690633
1 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
yml/OSBinaries/Tar.yml Normal file
View File

@@ -0,0 +1,22 @@
---
Name: Tar.exe
Description: Used by Windows to extract and create archives.
Author: 'Brian Lucero'
Created: 2023-01-30
Commands:
- Command: tar -xf \\host1\archive.tar
Description: Extracts archive.tar from the remote (internal) host (host1) to the current host.
Usecase: Copy files
Category: Copy
Privileges: User
MitreID: T1105
OperatingSystem: Windows 10, Windows 11
Full_Path:
- Path: C:\Windows\System32\tar.exe
Detection:
- IOC: tar.exe extracting files from a remote host within the environment
Resources:
- Link: https://twitter.com/Cyber_Sorcery/status/1619819249886969856
Acknowledgement:
- Person: Brian Lucero
Handle: '@Cyber_Sorcery'