public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-25 14:29:24 +01:00
Code Issues Projects Releases Wiki Activity

Merge pull request #163 from ajpc500/master

Browse Source 
added procdump dll load
This commit is contained in:
Oddvar Moe 2021-10-22 16:48:46 +02:00 committed by GitHub
commit e70295bc7c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
yml/OtherMSBinaries/Procdump.yml Normal file
View File

@ -0,0 +1,29 @@
---
Name: procdump(64).exe
Description: SysInternals Memory Dump Tool
Author: 'Alfie Champion (@ajpc500)'
Created: '2020-10-14'
Commands:
- Command: procdump.exe -md calc.dll explorer.exe
Description: Loads calc.dll where DLL is configured with a 'MiniDumpCallbackRoutine' exported function. Valid process must be provided as dump still created.
Usecase: Performs execution of unsigned DLL.
Category: Execute
Privileges: User
MitreID: T1202
MitreLink: https://attack.mitre.org/techniques/T1202
OperatingSystem: Windows 8.1 and higher, Windows Server 2012 and higher.
- Command: procdump.exe -md calc.dll foobar
Description: Loads calc.dll where configured with DLL_PROCESS_ATTACH execution, process argument can be arbitrary.
Usecase: Performs execution of unsigned DLL.
Category: Execute
Privileges: User
MitreID: T1202
MitreLink: https://attack.mitre.org/techniques/T1202
OperatingSystem: Windows 8.1 and higher, Windows Server 2012 and higher.
Detection:
- IOC: Process creation with given '-md' parameter
- IOC: Anomalous child processes of procdump
- IOC: Unsigned DLL load via procdump.exe or procdump64.exe
Resources:
- Link: https://twitter.com/ajpc500/status/1448588362382778372?s=20
---