public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-27 15:28:34 +01:00
Code Issues Projects Releases Wiki Activity

Create Ssh.yml (#211)

Browse Source 
* Create Ssh.yml

* newline ymlint

Co-authored-by: bohops <bohops>
This commit is contained in:
febou92 2022-12-29 19:45:09 -05:00 committed by GitHub
parent 1072d3dc34
commit ded90467a8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 9 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
yml/OSBinaries/Ssh.yml
View File

@ -1,4 +1,3 @@
---
Name: ssh.exe Name: ssh.exe
Description: Ssh.exe is the OpenSSH compatible client can be used to connect to Windows 10 (build 1809 and later) and Windows Server 2019 devices. Description: Ssh.exe is the OpenSSH compatible client can be used to connect to Windows 10 (build 1809 and later) and Windows Server 2019 devices.
Author: 'Akshat Pradhan' Author: 'Akshat Pradhan'
@ -11,18 +10,21 @@ Commands:
Privileges: User Privileges: User
MitreID: T1202 MitreID: T1202
OperatingSystem: Windows 10 1809, Windows Server 2019 OperatingSystem: Windows 10 1809, Windows Server 2019
- Command: ssh localhost calc.exe - Command: ssh -o ProxyCommand=calc.exe .
Description: Executes calc.exe. Description: Executes calc.exe from ssh.exe
Usecase: Performs execution of specified file, can be used to bypass Application Whitelisting. Usecase: Performs execution of specified file, can be used as a defensive evasion.
Category: AWL Bypass Category: Execute
Privileges: User Privileges: User
MitreID: T1218 MitreID: T1202
OperatingSystem: Windows 10 1809, Windows Server 2019 OperatingSystem: Windows 10
Full_Path: Full_Path:
- Path: c:\windows\system32\OpenSSH\ssh.exe - Path: c:\windows\system32\OpenSSH\ssh.exe
Detection: Detection:
- Sigma: https://github.com/SigmaHQ/sigma/blob/197615345b927682ab7ad7fa3c5f5bb2ed911eed/rules/windows/process_creation/proc_creation_win_lolbin_ssh.yml - Sigma: https://github.com/SigmaHQ/sigma/blob/197615345b927682ab7ad7fa3c5f5bb2ed911eed/rules/windows/process_creation/proc_creation_win_lolbin_ssh.yml
- IOC: Event ID 4624 with process name C:\Windows\System32\OpenSSH\sshd.exe. - IOC: Event ID 4624 with process name C:\Windows\System32\OpenSSH\sshd.exe.
- IOC: command line arguments specifying execution. - IOC: command line arguments specifying execution.
Resources:
- Link: https://gtfobins.github.io/gtfobins/ssh/
Acknowledgement: Acknowledgement:
- Person: Akshat Pradhan - Person: Akshat Pradhan
- Person: Felix Boulet