xenoscr
c24cad7868
Adding missing OperatingSystem values.
2022-09-10 23:48:38 -04:00
xenoscr
371d1cf2cc
Correcting case in Usecase key names.
2022-09-10 23:45:28 -04:00
xenoscr
a040ca3e40
Adding missing OperatingSystem values to Ieadvpack.yml
2022-09-10 23:41:38 -04:00
xenoscr
f5baac1c45
Adding missing authors
2022-09-10 23:37:10 -04:00
xenoscr
700d181c7e
Adding missing OperatingSystem key in Ilasm.yml
2022-09-10 23:30:36 -04:00
xenoscr
d585695b08
Adding missing Descriptions.
2022-09-10 23:26:10 -04:00
xenoscr
abb1034b00
Added missing description to Extexport.yml
2022-09-10 23:08:46 -04:00
xenoscr
dd58662ee9
Correcting 'UAC bypass' to 'UAC Bypass'
2022-09-10 22:58:06 -04:00
xenoscr
0ed1694bf1
Correcting 'AWL bypass' to 'AWL Bypass'
2022-09-10 22:55:32 -04:00
xenoscr
09e81d0bd1
Correcting Cmstp.yml Category value, case.
2022-09-10 22:48:08 -04:00
xenoscr
5e0ae9c976
Correcting Cmstp.yml Category value.
2022-09-10 22:46:13 -04:00
xenoscr
ce36f924fc
Removing extra --- from each yaml file
2022-09-10 22:16:47 -04:00
Ryan Stamp
8810e30f0a
Fix incorrect decodehex command syntax ( #230 )
2022-09-02 18:44:23 +01:00
securepeacock
68c14b894c
Update UtilityFunctions.yml ( #228 )
2022-09-02 18:42:59 +01:00
Wietze
e1df4e9f83
Merge remote-tracking branch 'upstream/master' into windows_11_sprint
2022-09-02 17:23:45 +01:00
Oddvar Moe
c5c227a7ba
added sigma detection for pester
2022-09-02 17:18:24 +01:00
Oddvar Moe
5a38aa722f
Adjusted comment in command
2022-09-02 17:18:24 +01:00
Oddvar Moe
4b99cadd85
Update pester.bat with an additional example
2022-09-02 17:18:23 +01:00
Wietze
400158f2df
Add sigma references to CL_LoadAssembly, CLMutexVerifiers entries ( #221 )
2022-09-02 17:16:58 +01:00
Grzegorz Tworek
9b70f38986
Create Ldifde.yml
2022-08-31 17:58:30 +02:00
Oddvar Moe
68a6f0a35f
added sigma detection for pester
2022-08-24 12:32:48 +02:00
721574n
4b564464fd
Added external reference for Rundll32
2022-08-24 12:11:31 +02:00
Oddvar Moe
c53a8ea06e
Adjusted comment in command
2022-08-23 15:47:17 +02:00
Oddvar Moe
fdc1b2c827
Update pester.bat with an additional example
2022-08-23 15:44:57 +02:00
fslds
3162825fdc
Split procdump name pattern into two actual names.
2022-08-08 20:27:04 +00:00
Oddvar Moe
8283d8d915
Delete Dllhost.yml
...
https://twitter.com/0gtweet/status/1533804788038647808
2022-06-09 10:51:40 +02:00
frack113
91350057ce
Add sigma references to CL_LoadAssembly, CLMutexVerifiers entries ( #221 )
2022-06-04 11:50:35 +01:00
Wietze
539c1da0fa
Merge branch 'master' into windows_11_sprint
2022-05-25 09:25:42 +01:00
Kostas
314f585da9
Update Hh.yml
...
Added SysWoW64 Path
2022-05-24 15:29:03 -07:00
Kostas
aae794c59c
Update Hh.yml
...
Fixing the full path of the hh.exe binary to C:\Windows\hh.exe
2022-05-24 14:23:18 -07:00
Wietze
7797a1967c
Merge branch 'master' into windows_11_sprint
2022-05-24 08:38:50 +01:00
frack113
f85eeb748a
Add Sigma references to conhost, imewdbld, ie4uinit, ilasm, offlinescannershell and replace ( #219 )
2022-05-23 12:35:58 +01:00
Chris "Lopi" Spehn
36945392ca
Merge pull request #201 from wietze/new/Conhost
...
Adding Conhost.exe LOLBAS
2022-05-19 10:27:10 -06:00
Chris "Lopi" Spehn
e872ce028b
Merge pull request #214 from jstnk9/master
...
Added new sigma rule and references to desk.cpl
2022-05-19 10:21:21 -06:00
ManuelBerrueta
68b772a567
Updated yml/OtherMSBinaries/Sqlps.yml, used recently in a campaign shared my Microsoft Security Intelligence. Would be useful reference for Red Teamers/Offensive Security Engineers as well as Blue Teamers/Defenders who reference this open source project/library.
2022-05-19 07:12:37 -07:00
John Dwyer
90b6082f1d
Update Rdrleakdiag.yml
2022-05-19 13:30:11 +00:00
John Dwyer
e2493d8ccf
Detection Resources and Other Updates (LOLBAS-Project#84)
...
https://github.com/LOLBAS-Project/LOLBAS/issues/84
2022-05-18 19:00:26 +00:00
John Dwyer
d935f096fd
Added rdrleakdiag dump
...
Added yaml for rdrleakdiag process dumping capability
2022-05-18 18:58:04 +00:00
frack113
d1738b946b
Adding various Sigma references ( #213 )
...
Co-authored-by: Wietze <wietze@users.noreply.github.com>
2022-05-17 09:18:45 +01:00
bohops
3571a7ad88
Create AccCheckConsole.yml ( #187 )
2022-05-15 21:55:16 +01:00
mrd0x
7c2f3231d3
Adding Dump64.exe ( #182 )
...
Co-authored-by: mrd0x <mrd0x@example.com>
Co-authored-by: Wietze <wietze@users.noreply.github.com>
2022-05-15 21:21:45 +01:00
Wietze
b333db4f91
Fixing typo (ieaframe -> ieframe)
2022-05-15 21:06:33 +01:00
akshat pradhan
79f4cbdb7f
Changed tid to T1105 for downloads ( #195 )
2022-05-15 20:38:24 +01:00
jstnk9
00bc9177bd
Added new sigma rule and references
...
Added new sigma rule and references
2022-05-15 16:42:44 +02:00
Wietze
2b20998371
Remove redundant powershell command from comsvcs entry
2022-05-05 11:18:39 +01:00
Wietze
b92ee99627
Addressing @bohops's feedback
2022-05-05 11:12:22 +01:00
bohops
d93539bf9b
Quick fix for syntax and removed IOC
2022-04-29 23:06:41 -04:00
cr1sp4
666e6e8645
Update Desk.yml ( #210 )
...
Added Sigma rules.
2022-04-29 22:52:57 -04:00
Wietze
619aafbfa2
Adding extra contributor to Desk.cpl entry
2022-04-28 13:01:35 +01:00
Wietze
4a8bdf4844
Fix casing on Desk.cpl entry
2022-04-27 11:20:13 +01:00
LuxNoBu!!shit
6ed0fb9326
Create Desk.cpl ( #207 )
...
Co-authored-by: Wietze <wietze@users.noreply.github.com>
2022-04-27 11:15:15 +01:00
Wietze
e4261b1f02
Fixing typo
2022-04-26 16:59:14 +01:00
Wietze
5c46dd63f5
Giving Hexacorn the proper credit
2022-04-07 15:50:39 +01:00
Wietze
4df2e43c82
Adding Conhost.exe LOLBAS
2022-04-05 18:46:58 +01:00
Wietze
55a7ea9a81
Fixing wlrmdr entry
2022-02-16 21:02:24 +00:00
Moshe Kaplan
12c85eb8f0
Create wlrmdr.yml ( #194 )
...
Co-authored-by: Wietze <wietze@users.noreply.github.com>
2022-02-16 20:41:14 +00:00
akshat pradhan
a7f7ec2cc2
Changing ATT&CK TID of wuauclt.exe entry ( #193 )
2022-01-23 22:24:59 +00:00
Andrew Kisliakov
e40a6432a0
Merge branch 'LOLBAS-Project:master' into master
2022-01-17 08:16:16 +00:00
Andrew Kisliakov
ada7f7f6c3
Microsoft Teams as a LOLbin
2022-01-17 08:11:47 +00:00
Wietze
085aaa37b1
Adding more missed-out entries
2021-12-15 11:50:18 +00:00
Wietze
52302853c9
Merge branch 'master' into windows_11_sprint
2021-12-14 17:39:36 +00:00
Wietze
e51caad3dd
Adding Windows 11 reference to missed-out executables
2021-12-14 16:57:56 +00:00
Wietze
6793a7d238
Fixing various issues identified
2021-12-14 16:50:22 +00:00
Wietze
adf171d089
Applying minor format changes (incorrectly formatted dates, typos, etc.)
2021-12-14 15:53:03 +00:00
Wietze
754a451e76
Updating entries that have been confirmed to be working on Windows 11 (21H2)
2021-12-14 15:51:43 +00:00
Wietze
39d4e815af
Minor formatting changes (redudant backslashes, incorrect dates, typos, etc.)
2021-12-14 14:57:32 +00:00
whickey-r7
18bceb7639
Create Unregmp2.yml
...
Added a new lolbin, unregmp2.exe, used for proxying execution.
2021-12-06 12:13:24 -05:00
frack113
17899acbb0
Adding Sigma references to ConfigSecurityPolicy, Diantz, ExtExport & Extrac32 ( #184 )
2021-12-06 11:19:01 +00:00
frack113
2d28767c04
Adding new Sigma references (AppInstaller, AspnetCompiler, Bash, Certreq) ( #183 )
2021-11-25 09:42:26 +00:00
Wietze
f7b30775a4
Odbcconf realign to T1218.008, hh.exe to T1218.001
2021-11-16 14:09:37 +00:00
bohops
23dd0236ae
Detection Resources and Other Updates ( #179 )
...
* Add detection links for scripts
* Add detection links for OtherMSBins. Fixed and updated as needed.
* Add detection links for MSBins. Fixed and updated as needed.
* Add detection links for oslibraries
* Updating template for Detections
* Removing empty Detection:Sigma entries
* Remove redundant blank line
* Replacing commit URL with file URL
Co-authored-by: root <root@DESKTOP-5CR935D.localdomain>
Co-authored-by: Wietze <wietze@users.noreply.github.com>
2021-11-15 08:19:03 -05:00
Wietze
4860585fb7
Adding CustomShellHost.exe LOLBAS
2021-11-14 23:26:39 +00:00
akshat pradhan
2031916b1a
ATT&CK realignment, typo fixes ( #178 )
...
* Corrected Mitre TID for pnputil
* Fixed Command misspells
2021-11-14 17:27:17 +00:00
akshat pradhan
53a4070205
Fixed formating
2021-11-09 08:16:34 +05:30
akshat pradhan
33a8da933c
Added AWL Bypass to Ssh.yml
2021-11-09 08:14:43 +05:30
akshat pradhan
dfc7d40b1f
Create Ssh
2021-11-08 22:21:37 +05:30
Wietze
2380c506d4
LSASS realign to T1003.001
2021-11-05 20:35:58 +00:00
Wietze
df8c88f4ca
Remaping NTDS entries to T1003.003
2021-11-05 20:32:44 +00:00
Wietze
8257d60aad
Realigning .ps1 scripts to T1216
2021-11-05 20:29:07 +00:00
Wietze
bc51cb4e03
More changes (mainly changing some T1218 instances to T1202)
2021-11-05 20:19:39 +00:00
Wietze
2577066af9
More changes (mainly changing generic T1218 to dev-specific T1127)
2021-11-05 20:06:57 +00:00
Wietze
8286677dac
Applying more specific subtechniques to Verclsid
2021-11-05 19:38:21 +00:00
Wietze
80e3f67e44
Applying more specific subtechniques to At/Schtasks, closes LOLBAS-Project/LOLBAS#113
2021-11-05 19:33:59 +00:00
Wietze
4f7ec8d2af
MITRE ATT&CK realignment sprint
2021-11-05 18:58:26 +00:00
Ensar Şamil
97f5042a58
Update Certoc.yml ( #168 )
...
Co-authored-by: Wietze <wietze@users.noreply.github.com>
2021-10-27 10:02:52 +01:00
Oddvar Moe
5db35bb397
Updated msbuild with logger technique
2021-10-26 00:27:35 +02:00
Oddvar Moe
7aeed60864
Updated msbuild with logger technique
2021-10-26 00:19:57 +02:00
Oddvar Moe
b91c7ddab5
Updated msbuild with logger technique
2021-10-26 00:17:08 +02:00
Wietze
ca11578655
Archiving off legacy LOLUtilz
2021-10-25 21:32:59 +01:00
Wietze
fa3ff39cac
Update Nvudisp.yml
2021-10-25 12:33:19 +01:00
Wietze
d411d9572b
Create Finger.exe ( #154 )
...
Closes #24 , #123
2021-10-25 12:30:32 +01:00
Wietze
eafc1982f0
Website update
2021-10-25 12:28:09 +01:00
Wietze
234eb99a7d
Formatting
2021-10-25 12:27:00 +01:00
Wietze
afe93672a4
Minor updates
2021-10-25 12:25:13 +01:00
Oddvar Moe
7a34f57a31
Update Procdump.yml
2021-10-22 16:49:59 +02:00
Oddvar Moe
e70295bc7c
Merge pull request #163 from ajpc500/master
...
added procdump dll load
2021-10-22 16:48:46 +02:00
Oddvar Moe
1b15eccf07
Merge branch 'master' into master
2021-10-22 16:46:18 +02:00
Oddvar Moe
58b5eb7513
Update OneDriveStandaloneUpdater.yml
2021-10-22 16:43:28 +02:00
Oddvar Moe
a509625acc
Update OneDriveStandaloneUpdater.yml
2021-10-22 16:41:56 +02:00
Oddvar Moe
70a061d301
Merge pull request #153 from elliotkillick/OneDriveStandaloneUpdater
...
Create OneDriveStandaloneUpdater.yml
2021-10-22 16:39:14 +02:00
Oddvar Moe
486b5fc1ef
Merge pull request #152 from elliotkillick/SettingSyncHost
...
Create SettingSyncHost.yml
2021-10-22 16:36:13 +02:00
Oddvar Moe
44f88df089
Update Cmdl32.yml
2021-10-22 16:34:41 +02:00
Oddvar Moe
ccb20e560c
Rename cmdl32.yml to Cmdl32.yml
2021-10-22 16:33:24 +02:00
Oddvar Moe
5a62424a79
Merge pull request #151 from elliotkillick/cmdl32
...
Create cmdl32.yml
2021-10-22 16:32:42 +02:00
Oddvar Moe
fb9b6d65d5
Update cmdl32.yml
2021-10-22 16:31:54 +02:00
Oddvar Moe
adcb7e0c57
Merge pull request #150 from elliotkillick/OfflineScannerShell
...
Create OfflineScannerShell.yml
2021-10-22 16:28:33 +02:00
Oddvar Moe
c04d90c533
Merge pull request #149 from elliotkillick/WorkFolders
...
Create WorkFolders.yml
2021-10-22 16:26:50 +02:00
Oddvar Moe
8c1b97629b
Merge pull request #146 from elliotkillick/PrintBrm
...
Create PrintBrm.yml
2021-10-22 16:21:21 +02:00
Oddvar Moe
d9e31e2291
Rename fltMC.yml to FltMC.yml
2021-10-22 16:04:27 +02:00
Oddvar Moe
6bda2344eb
Rename certoc.yml to Certoc.yml
2021-10-22 16:04:12 +02:00
Oddvar Moe
e32f944030
Merge pull request #162 from esebese/master
...
Create certoc.yml
2021-10-22 16:02:20 +02:00
Oddvar Moe
985bda094e
Merge pull request #164 from eral4m/master
...
Create Stordiag.yml
2021-10-22 15:58:35 +02:00
Oddvar Moe
30a9f90f5f
Update Stordiag.yml
2021-10-22 15:56:52 +02:00
Oddvar Moe
9f9af1cfee
Merge branch 'master' into feat/yamllinting
2021-10-22 15:20:35 +02:00
Oddvar Moe
a55e2249c1
Merge branch 'master' into fixing-yaml-issues
2021-10-22 14:53:09 +02:00
Elliot Killick
a1d7fd00c9
Acknowledge John Carroll and their resource
2021-10-21 05:36:18 -04:00
eral4m
8b49ca2054
Update Stordiag.yml
2021-10-21 10:30:54 +01:00
eral4m
b723258dbf
Update Stordiag.yml
2021-10-21 10:30:31 +01:00
eral4m
6da5480936
Update Stordiag.yml
2021-10-21 10:14:04 +01:00
eral4m
fd2a31b43b
Create Stordiag.yml
2021-10-21 10:00:47 +01:00
Elliot Killick
6fb1882a16
Add resources section
2021-10-18 23:38:45 -04:00
ajpc500
079e3cd72a
added procdump dll load
2021-10-14 17:32:17 +01:00
Ensar Şamil
6b6fd3fd62
Create certoc.yml
2021-10-07 13:31:45 +03:00
antonioCoco
87bb8cfd3e
Update Rpcping.yml
2021-09-29 23:31:06 +02:00
antonioCoco
27b1f9bfb1
Update Rpcping.yml
2021-09-29 23:27:16 +02:00
bohops
741d0f7b36
Update CL_LoadAssembly.yml
2021-09-26 23:35:01 -04:00
root
b5357cdec0
Adding app-ctrl bypass bins and a few lolscripts
2021-09-26 23:31:30 -04:00
bohops
c48a5ea1ea
Merge pull request #159 from timwhitez/master
...
Create VSIISExeLauncher.yml
2021-09-25 22:51:39 -04:00
bohops
3475ce1213
Merge pull request #158 from JohnLaTwC/patch-1
...
Add lolbin for fltMC.exe
2021-09-25 22:47:30 -04:00
bohops
cab273394a
Merge pull request #126 from ahmadalsabagh/fix
...
Fixed the resources link
2021-09-25 22:30:23 -04:00
bohops
6c20e750e8
Merge pull request #144 from defensivedepth/patch-1
...
Fix ART link
2021-09-25 22:22:42 -04:00
bohops
198b421d15
Merge pull request #130 from whickey-r7/patch-3
...
Create IMEWDBLD.yml
2021-09-25 22:07:23 -04:00
bohops
c51df24076
Merge pull request #129 from SpookySec/cdb-update
...
edited cdb.yml
2021-09-25 21:40:09 -04:00
TimWhite
9336b4d599
Update VSIISExeLauncher.yml
2021-09-24 15:28:39 +08:00
TimWhite
559d9bc3ff
Create VSIISExeLauncher.yml
2021-09-24 15:28:01 +08:00
John Lambert
ecbc2f817f
Add lolbin for fltMC.exe
...
Used by redteams for defense evasion to disable drivers used by agents like sysmon
https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon
https://github.com/oddcod3/Phantom-Evasion/blob/master/Modules/post-exploitation/Postex_CMD_UnloadSysmonDriver_windows.py
2021-09-18 17:43:59 -07:00
Ruben
bb73c013fb
Update Finger.yml
...
Fixed header and footer
2021-08-30 13:30:52 +02:00
Rubén
670a5f1870
Create Finger.exe
2021-08-30 13:16:08 +02:00
Elliot Killick
6e047908a4
Create OneDriveStandaloneUpdater.yml
2021-08-28 05:16:35 -04:00
Elliot Killick
02207882f6
Create cmdl32.yml
2021-08-28 00:55:50 -04:00
Elliot Killick
3b1fd0ea8e
Create SettingSyncHost.yml
2021-08-26 13:35:15 -04:00
Elliot Killick
692a3bf4c2
Remove .exe from command and increase specificity
2021-08-26 12:49:43 -04:00
Elliot Killick
34af96f564
Remove .exe from command
2021-08-26 12:21:34 -04:00
Elliot Killick
084fb83984
Remove .exe from command and increase specificity
2021-08-26 12:07:04 -04:00
bohops
f51a70c03e
Merge pull request #143 from Efraim-Kaplan/patch-1
...
Fixed Typo
2021-08-26 09:08:40 -04:00
Elliot Killick
d521284bb9
Create DeviceCredentialDeployment.yml
2021-08-16 20:21:48 -04:00
Elliot Killick
26a15f55cf
Create OfflineScannerShell.yml
2021-08-16 19:46:47 -04:00
Elliot Killick
95baee85fd
Create WorkFolders.yml
2021-08-16 19:42:32 -04:00
Elliot Killick
5ba729ee1d
Create fsutil.yml
2021-08-16 19:37:37 -04:00
Elliot Killick
63af8cca3b
Add resources section and improve formatting
2021-07-10 11:54:35 -04:00
Josh Brower
87c3319ad4
Fix ART link
2021-07-06 13:56:24 -04:00
Efraim-Kaplan
ebf494ae4d
FIxed typo
...
Replaced "handeling" with "handling".
2021-07-02 17:33:53 -04:00
Elliot Killick
8f705bb7a4
Create PrintBrm.yml
...
New lolbin for zipping & unzipping to and from UNC paths and ADS. The zip file could also serve as a useful form of obfuscation for evading detection.
2021-06-22 02:11:27 +00:00
Parker McGee
bbf14cf4b9
Fix a typo in Findstr.yml
...
`finstr.exe` should be `findstr.exe`
2021-03-20 16:40:37 -04:00
Filipe Spencer Lopes
29acd82968
putting quotes around strings with special chars
2021-03-09 15:04:09 +01:00
Filipe Spencer Lopes
ff9f5cff3d
Removing blank lines
2021-03-09 15:00:55 +01:00
Filipe Spencer Lopes
b0a321e4c4
Too many whitespaces
2021-03-09 14:58:44 +01:00
Filipe Spencer Lopes
a232cfa007
Too many empty lines
2021-03-09 14:57:47 +01:00
Filipe Spencer Lopes
13901ea496
Too many whitespaces
2021-03-09 14:57:01 +01:00
Filipe Spencer Lopes
56035a7d10
Too many whitespaces
2021-03-09 14:56:47 +01:00
whickey-r7
782bc68c7c
Create IMEWDBLD.yml
2021-03-05 11:35:06 -05:00
SpookySec
d539a7dacd
edited cdb.yml
2021-02-12 22:26:16 +03:00
SpookySec
84de927a83
edited cdb.yml
2021-02-08 16:28:25 +03:00
ahmad
3ca7bdc542
Fixed the url
2021-01-22 06:33:58 -05:00
Oddvar Moe
7c1a4a7959
Merge pull request #125 from wokis/master
...
Added detection by Microsoft Defender Antivirus as Behavior:Win32/UACBypassExp.T!gen
2021-01-21 22:58:24 +01:00
Oddvar Moe
9ce6984dd7
Merge pull request #121 from ahmadalsabagh/adplus.exe
...
Create Adplus.yml
2021-01-21 22:56:34 +01:00
Oddvar Moe
b79a48f082
Fixed Category on pnputil
2021-01-21 22:54:58 +01:00
Oddvar Moe
515235a202
Merge pull request #120 from ahmadalsabagh/remote.exe
...
Create remote.yml
2021-01-21 22:52:24 +01:00
Oddvar Moe
2406d99f33
Rename pnputil.yml to Pnputil.yml
...
Casing
2021-01-21 22:49:19 +01:00
Oddvar Moe
64914b641c
Adjusted error on pnputil yml file
2021-01-21 22:48:05 +01:00
Oddvar Moe
5b9c4f63dc
Merge pull request #118 from LuxNoBulIshit/master
...
Pnputil.exe
2021-01-21 22:42:40 +01:00
Oddvar Moe
394d3c66f9
Merge pull request #112 from zeroSteiner/patch-1
...
Update the affected operating systems for SyncAppvPublishingServer
2021-01-21 22:35:50 +01:00
Oddvar Moe
e9e458d6b7
Merge pull request #111 from michalani/patch-1
...
Addded missing path for winword.exe
2021-01-21 22:32:24 +01:00
Oddvar Moe
97176a0a07
Merge pull request #110 from whickey-r7/patch-2
...
Create AppInstaller.yml
2021-01-21 22:29:35 +01:00
Oddvar Moe
6774d228a5
Merge pull request #109 from unexpectedBy/patch-2
...
Create DataSvcUtil.yml
2021-01-21 22:24:02 +01:00
Oddvar Moe
1bf91d246a
Merge pull request #107 from nasbench/adding-dllhost-lolbin
...
Create Dllhost.yml
2021-01-21 22:20:03 +01:00
wokis
00935f154e
Update Wsreset.yml
...
Added detection by Microsoft Defender Antivirus as Behavior:Win32/UACBypassExp.T!gen
2021-01-20 14:47:23 +01:00
Wietze
2e08819eef
Fix Usecase field
2021-01-10 15:54:00 +00:00
Wietze
5012f95152
Fix Code_Sample field
2021-01-10 15:49:30 +00:00
Wietze
fc223eb3d8
Remove/fix unnecessary Categories field
2021-01-10 15:48:20 +00:00
Wietze
5ec4de562b
Fixed acknowledgements
2021-01-10 15:45:25 +00:00
Wietze
38f9a0a032
Fixed incorrect MItreLink
2021-01-10 15:26:27 +00:00
Wietze
14dca38278
Standardise date formats (see https://yaml.org/type/timestamp.html )
2021-01-10 15:04:52 +00:00
Wietze
de50a47957
Fix invalid YAML
2021-01-10 14:46:36 +00:00
Ahmad AS
be69f54245
Update Adplus.yml
2021-01-09 03:00:05 -05:00
ahmad
080fe4ca5b
Create Adplus.yml
2021-01-09 02:56:32 -05:00
Ahmad AS
4254927f78
Update Remote.yml
2021-01-06 23:31:01 -05:00
ahmad
7dab1b916e
Create remote.yml
2021-01-06 20:48:25 -05:00
LuxNoBu!!shit
0d819439c5
Create pnputil.exe
2020-12-25 12:14:15 -08:00
Spencer McIntyre
deb249042b
Update the affected operating systems for SyncAppvPublishingServer
2020-12-08 15:32:35 -05:00
michalani
36b28ddd98
Update Winword.yml
2020-12-03 01:03:08 +00:00
whickey-r7
b381d04faf
Create AppInstaller.yml
...
New lolbin for downloading files in Windows 10.
2020-12-02 11:35:49 -05:00
unload
bfe248b07e
Create DataSvcUtil.yml
...
Another data exfil way with lolbins
2020-12-01 22:57:09 -03:00
Nasreddine Bencherchali
15d5ff302d
Create Dllhost.yml
2020-11-07 14:22:24 +01:00
jesgal
483482e3a3
Create Upload.yml
...
File describing the execution of LolBin Update.exe deployed with the installation of Whatsapp on Windows operating systems.
2020-11-01 20:09:41 +01:00
jesgal
4c67be51c1
Delete Update.yml
2020-11-01 20:05:25 +01:00
jesgal
748cfb4223
Merge pull request #2 from jesgal/jesgal-persistence-update
...
Update Update.yml
2020-11-01 19:53:13 +01:00
jesgal
31c7d34a00
Create Update.yml
...
This file describes LoLbin Update.exe deployed in the Whatsapp installation for Windows Operating Systems.
2020-11-01 19:50:59 +01:00
jesgal
9642f81be7
Update Update.yml
...
I update this LolBin to create persistence of payload.exe in the directory "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup" by running payload.exe with the argument "--createShortcut" and "--removeShortcut".
2020-10-29 09:12:28 +01:00
Conor Richard
d15172284a
Merge pull request #101 from leo1-1/master
...
added command to certutil
2020-10-26 19:44:53 -04:00
