public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-07-27 12:42:19 +02:00
Code Issues Projects Releases Wiki Activity

Remaping NTDS entries to T1003.003

Browse Source
This commit is contained in:
Wietze
2021-11-05 20:32:44 +00:00
parent 8257d60aad
commit df8c88f4ca
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
yml/OSBinaries/Diskshadow.yml
View File

@@ -9,7 +9,7 @@ Commands:
Usecase: Use diskshadow to exfiltrate data from VSS such as NTDS.dit
Category: Dump
Privileges: User
MitreID: T1218
MitreID: T1003.003
OperatingSystem: Windows server
- Command: diskshadow> exec calc.exe
Description: Execute commands using diskshadow.exe to spawn child process