public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-28 15:58:24 +01:00
Code Issues Projects Releases Wiki Activity

Update Dxcap.yml (#296)

Browse Source 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
Vikas Singh 2023-06-27 18:12:47 +05:30 committed by GitHub
parent 62ed936a39
commit fa3f6bbc0c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
yml/OtherMSBinaries/Dxcap.yml
View File

@ -5,8 +5,8 @@ Author: 'Oddvar Moe'
Created: 2018-05-25 Created: 2018-05-25
Commands: Commands:
- Command: Dxcap.exe -c C:\Windows\System32\notepad.exe - Command: Dxcap.exe -c C:\Windows\System32\notepad.exe
Description: Launch notepad as a subprocess of Dxcap.exe Description: 'Launch notepad.exe as a subprocess of dxcap.exe. Note that you should have write permissions in the current working directory for the command to succeed; alternatively, add ''-file c:\path\to\writable\location.ext'' as first argument.'
Usecase: Local execution of a process as a subprocess of Dxcap.exe Usecase: Local execution of a process as a subprocess of dxcap.exe
Category: Execute Category: Execute
Privileges: User Privileges: User
MitreID: T1127 MitreID: T1127
@ -14,8 +14,6 @@ Commands:
Full_Path: Full_Path:
- Path: C:\Windows\System32\dxcap.exe - Path: C:\Windows\System32\dxcap.exe
- Path: C:\Windows\SysWOW64\dxcap.exe - Path: C:\Windows\SysWOW64\dxcap.exe
Code_Sample:
- Code:
Detection: Detection:
- Sigma: https://github.com/SigmaHQ/sigma/blob/08ca62cc8860f4660e945805d0dd615ce75258c1/rules/windows/process_creation/win_susp_dxcap.yml - Sigma: https://github.com/SigmaHQ/sigma/blob/08ca62cc8860f4660e945805d0dd615ce75258c1/rules/windows/process_creation/win_susp_dxcap.yml
Resources: Resources:
@ -23,3 +21,5 @@ Resources:
Acknowledgement: Acknowledgement:
- Person: Matt harr0ey - Person: Matt harr0ey
Handle: '@harr0ey' Handle: '@harr0ey'
- Person: Vikas Singh
Handle: '@vikas891'