diff --git a/yml/OSLibraries/Shdocvw.yml b/yml/OSLibraries/Shdocvw.yml index 305983e..d6d3da5 100644 --- a/yml/OSLibraries/Shdocvw.yml +++ b/yml/OSLibraries/Shdocvw.yml @@ -6,23 +6,24 @@ Created: '2018-05-25' Commands: - Command: rundll32.exe shdocvw.dll,OpenURL "C:\test\calc.url" Description: Launch an executable payload via proxy through a(n) URL (information) file by calling OpenURL. - Usecase: Load an executable payload by calling a .url file with or without quotes. The .url file extension can be renamed. + UseCase: Load an executable payload by calling a .url file with or without quotes. The .url file extension can be renamed. Category: Execution Privileges: User MitreID: T1085 MItreLink: https://attack.mitre.org/wiki/Technique/T1085 OperatingSystem: Windows Full Path: - - path: c:\windows\system32\shdocvw.dll - - path: c:\windows\syswow64\shdocvw.dll + - Path: c:\windows\system32\shdocvw.dll + - Path: c:\windows\syswow64\shdocvw.dll Code Sample: - - https://gist.githubusercontent.com/bohops/89d7b11fa32062cfe31be9fdb18f050e/raw/1206a613a6621da21e7fd164b80a7ff01c5b64ab/calc.url -Detection: [] + - Code: https://gist.githubusercontent.com/bohops/89d7b11fa32062cfe31be9fdb18f050e/raw/1206a613a6621da21e7fd164b80a7ff01c5b64ab/calc.url +Detection: + - IOC: '' Resources: - - resource: http://www.hexacorn.com/blog/2018/03/15/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-5/ - - resource: https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/ - - resource: https://twitter.com/bohops/status/997690405092290561 - - resource: https://windows10dll.nirsoft.net/shdocvw_dll.html + - Link: http://www.hexacorn.com/blog/2018/03/15/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-5/ + - Link: https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/ + - Link: https://twitter.com/bohops/status/997690405092290561 + - Link: https://windows10dll.nirsoft.net/shdocvw_dll.html Acknowledgment: - Person: Adam Handle: '@hexacorn'