mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2024-12-25 14:29:24 +01:00
Fix invalid YAML
This commit is contained in:
parent
d15172284a
commit
de50a47957
@ -21,7 +21,7 @@ Detection:
|
||||
Resources:
|
||||
- Link: https://bartblaze.blogspot.com/2019/03/run-applications-and-scripts-using.html
|
||||
- Link: https://twitter.com/bartblaze/status/1107390776147881984
|
||||
Acknowledgement:
|
||||
Acknowledgement:
|
||||
- Person: Bart
|
||||
Handle: @bartblaze
|
||||
Handle: '@bartblaze'
|
||||
---
|
||||
|
@ -1,20 +1,18 @@
|
||||
Name: aswrundll.exe
|
||||
Description: This process is used by AVAST antivirus to run and execute any modules
|
||||
Author: Eli Salem
|
||||
Created: 19\03\2019
|
||||
Created: 2019-03-19
|
||||
Commands:
|
||||
- Command: "C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll"
|
||||
- Command: "\"C:\\Program Files\\Avast Software\\Avast\\aswrundll\" \"C:\\Users\\Public\\Libraries\\tempsys\\module.dll\""
|
||||
Description: Load and execute modules using aswrundll
|
||||
Usecase: Execute malicious modules using aswrundll.exe
|
||||
Category: Execute
|
||||
Privileges: Any
|
||||
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
|
||||
Full_Path:
|
||||
- Path: C:\Program Files\Avast Software\Avast\aswrundll
|
||||
Code_Sample:
|
||||
- Code: ["C:\Program Files\Avast Software\Avast\aswrundll" "C:\Users\Public\Libraries\tempsys\module.dll" "C:\Users\module.dll"]
|
||||
- Path: C:\Program Files\Avast Software\Avast\aswrundll
|
||||
Resources:
|
||||
- Link: https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research
|
||||
Acknowledgement:
|
||||
- Link: https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research
|
||||
Acknowledgement:
|
||||
- Person: Eli Salem
|
||||
handle: https://www.linkedin.com/in/eli-salem-954728150
|
||||
Handle: https://www.linkedin.com/in/eli-salem-954728150
|
||||
|
Loading…
Reference in New Issue
Block a user