public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-01-14 07:41:38 +01:00
Code Issues Projects Releases Wiki Activity

Cipher.YML updated

Browse Source
This commit is contained in:
iamtutu 2024-11-22 13:25:50 -05:00 committed by GitHub
parent abbb1e1ccf
commit f92708015b
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 2 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
yml/OSBinaries/cipher.yml → yml/OSBinaries/Cipher.yml
View File

@ -1,6 +1,6 @@
--- ---
Name: Cipher.exe Name: Cipher.exe
Description: Windows binary can be used to overwrite deleted data in Windows direoctry and volume Description: Windows binary can be used to overwrite deleted data in Windows directory and volume
Author: Adetutu Ogunsowo Author: Adetutu Ogunsowo
Created: 2024-11-22 # YYYY-MM-DD (date the person created this file) Created: 2024-11-22 # YYYY-MM-DD (date the person created this file)
Commands: Commands:
@ -9,15 +9,12 @@ Commands:
Usecase: Attacker wants to permanently delete their artefacts, evidence, logs etc. and cannot be retrived by forensics means Usecase: Attacker wants to permanently delete their artefacts, evidence, logs etc. and cannot be retrived by forensics means
Category: Encode Category: Encode
Privileges: User Privileges: User
MitreID: T1485.001 MitreID: T1485.001
OperatingSystem: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11 OperatingSystem: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Full_Path: Full_Path:
- Path: c:\windows\system32\cipher.exe - Path: c:\windows\system32\cipher.exe
- Path: c:\windows\syswow64\cipher.exe - Path: c:\windows\syswow64\cipher.exe
Code_Sample:
- Code:
Detection: Detection:
- IOC: Event ID 10
- IOC: cipher.exe spawned - IOC: cipher.exe spawned
Resources: Resources:
- Link: https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/ - Link: https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/