mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2024-12-27 07:18:05 +01:00
Added lolbas iediagcmd.exe as discovered by Adam @hexacorn (#199)
Everything looks good, confirmed working on Windows 10 & 11, merging changes: * Added 'Execute' lolbas for iediagcmd.exe * Added missing fields from the template * Update Iediagcmd.yml Made corrections * Update Iediagcmd.yml Removing trailing spaces * Update Iediagcmd.yml removing empty fields * Minor changes * Update Iediagcmd.yml Removing space before first "&". When setting the Environment variable, it's picking up the space so the path seemed to be "c:\test \", which is why tests are failing. * Adding Windows 11 support --------- Co-authored-by: Conor Richard <xenos@xenos-1.net> Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
parent
90f666e7a0
commit
d6e4fb07d5
24
yml/OSBinaries/Iediagcmd.yml
Normal file
24
yml/OSBinaries/Iediagcmd.yml
Normal file
@ -0,0 +1,24 @@
|
||||
---
|
||||
Name: iediagcmd.exe
|
||||
Description: Diagnostics Utility for Internet Explorer
|
||||
Author: manasmbellani
|
||||
Created: 2022-03-29
|
||||
Commands:
|
||||
- Command: 'set windir=c:\test& cd "C:\Program Files\Internet Explorer\" & iediagcmd.exe /out:c:\test\foo.cab'
|
||||
Description: Executes binary that is pre-planted at C:\test\system32\netsh.exe.
|
||||
Usecase: Spawn a pre-planted executable from iediagcmd.exe.
|
||||
Category: Execute
|
||||
Privileges: User
|
||||
MitreID: T1218
|
||||
OperatingSystem: Windows 10 1803, Windows 10 1703, Windows 10 22H1, Windows 10 22H2, Windows 11
|
||||
Full_Path:
|
||||
- Path: C:\Program Files\Internet Explorer\iediagcmd.exe
|
||||
Detection:
|
||||
- Sigma: https://github.com/manasmbellani/mycode_public/blob/master/sigma/rules/win_proc_creation_lolbin_iediagcmd.yml
|
||||
- IOC: Sysmon Event ID 1
|
||||
- IOC: Execution of process iediagcmd.exe with /out could be suspicious
|
||||
Resources:
|
||||
- Link: https://twitter.com/Hexacorn/status/1507516393859731456
|
||||
Acknowledgement:
|
||||
- Person: Adam
|
||||
Handle: '@hexacorn'
|
Loading…
Reference in New Issue
Block a user