public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-11-04 10:39:56 +01:00
Code Issues Projects Releases Wiki Activity
646 Commits 4 Branches 0 Tags
50c481795b3c6081209a4b5cd89ee26646828576
Commit Graph

509 Commits

Author SHA1 Message Date
Wietze
400158f2df Add sigma references to CL_LoadAssembly, CLMutexVerifiers entries (#221) 2022-09-02 17:16:58 +01:00
Grzegorz Tworek
9b70f38986 Create Ldifde.yml 2022-08-31 17:58:30 +02:00
Oddvar Moe
68a6f0a35f added sigma detection for pester 2022-08-24 12:32:48 +02:00
721574n
4b564464fd Added external reference for Rundll32 2022-08-24 12:11:31 +02:00
Oddvar Moe
c53a8ea06e Adjusted comment in command 2022-08-23 15:47:17 +02:00
Oddvar Moe
fdc1b2c827 Update pester.bat with an additional example 2022-08-23 15:44:57 +02:00
fslds
3162825fdc Split procdump name pattern into two actual names. 2022-08-08 20:27:04 +00:00
Oddvar Moe
8283d8d915 Delete Dllhost.yml 
https://twitter.com/0gtweet/status/1533804788038647808
 2022-06-09 10:51:40 +02:00
frack113
91350057ce Add sigma references to CL_LoadAssembly, CLMutexVerifiers entries (#221) 2022-06-04 11:50:35 +01:00
Wietze
539c1da0fa Merge branch 'master' into windows_11_sprint 2022-05-25 09:25:42 +01:00
Kostas
314f585da9 Update Hh.yml 
Added SysWoW64 Path
 2022-05-24 15:29:03 -07:00
Kostas
aae794c59c Update Hh.yml 
Fixing the full path of the hh.exe binary to C:\Windows\hh.exe
 2022-05-24 14:23:18 -07:00
Wietze
7797a1967c Merge branch 'master' into windows_11_sprint 2022-05-24 08:38:50 +01:00
frack113
f85eeb748a Add Sigma references to conhost, imewdbld, ie4uinit, ilasm, offlinescannershell and replace (#219) 2022-05-23 12:35:58 +01:00
Chris "Lopi" Spehn
36945392ca Merge pull request #201 from wietze/new/Conhost 
Adding Conhost.exe LOLBAS
 2022-05-19 10:27:10 -06:00
Chris "Lopi" Spehn
e872ce028b Merge pull request #214 from jstnk9/master 
Added new sigma rule and references to desk.cpl
 2022-05-19 10:21:21 -06:00
ManuelBerrueta
68b772a567 Updated yml/OtherMSBinaries/Sqlps.yml, used recently in a campaign shared my Microsoft Security Intelligence. Would be useful reference for Red Teamers/Offensive Security Engineers as well as Blue Teamers/Defenders who reference this open source project/library. 2022-05-19 07:12:37 -07:00
John Dwyer
90b6082f1d Update Rdrleakdiag.yml 2022-05-19 13:30:11 +00:00
John Dwyer
e2493d8ccf Detection Resources and Other Updates (LOLBAS-Project#84) 
https://github.com/LOLBAS-Project/LOLBAS/issues/84
 2022-05-18 19:00:26 +00:00
John Dwyer
d935f096fd Added rdrleakdiag dump 
Added yaml for rdrleakdiag process dumping capability
 2022-05-18 18:58:04 +00:00
frack113
d1738b946b Adding various Sigma references (#213) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2022-05-17 09:18:45 +01:00
bohops
3571a7ad88 Create AccCheckConsole.yml (#187) 2022-05-15 21:55:16 +01:00
mrd0x
7c2f3231d3 Adding Dump64.exe (#182) 
Co-authored-by: mrd0x <mrd0x@example.com>
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2022-05-15 21:21:45 +01:00
Wietze
b333db4f91 Fixing typo (ieaframe -> ieframe) 2022-05-15 21:06:33 +01:00
akshat pradhan
79f4cbdb7f Changed tid to T1105 for downloads (#195) 2022-05-15 20:38:24 +01:00
jstnk9
00bc9177bd Added new sigma rule and references 
Added new sigma rule and references
 2022-05-15 16:42:44 +02:00
Wietze
2b20998371 Remove redundant powershell command from comsvcs entry 2022-05-05 11:18:39 +01:00
Wietze
b92ee99627 Addressing @bohops's feedback 2022-05-05 11:12:22 +01:00
bohops
d93539bf9b Quick fix for syntax and removed IOC 2022-04-29 23:06:41 -04:00
cr1sp4
666e6e8645 Update Desk.yml (#210) 
Added Sigma rules.
 2022-04-29 22:52:57 -04:00
Wietze
619aafbfa2 Adding extra contributor to Desk.cpl entry 2022-04-28 13:01:35 +01:00
Wietze
4a8bdf4844 Fix casing on Desk.cpl entry 2022-04-27 11:20:13 +01:00
LuxNoBu!!shit
6ed0fb9326 Create Desk.cpl (#207) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2022-04-27 11:15:15 +01:00
Wietze
e4261b1f02 Fixing typo 2022-04-26 16:59:14 +01:00
Wietze
5c46dd63f5 Giving Hexacorn the proper credit 2022-04-07 15:50:39 +01:00
Wietze
4df2e43c82 Adding Conhost.exe LOLBAS 2022-04-05 18:46:58 +01:00
Wietze
55a7ea9a81 Fixing wlrmdr entry 2022-02-16 21:02:24 +00:00
Moshe Kaplan
12c85eb8f0 Create wlrmdr.yml (#194) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2022-02-16 20:41:14 +00:00
akshat pradhan
a7f7ec2cc2 Changing ATT&CK TID of wuauclt.exe entry (#193) 2022-01-23 22:24:59 +00:00
Wietze
085aaa37b1 Adding more missed-out entries 2021-12-15 11:50:18 +00:00
Wietze
52302853c9 Merge branch 'master' into windows_11_sprint 2021-12-14 17:39:36 +00:00
Wietze
e51caad3dd Adding Windows 11 reference to missed-out executables 2021-12-14 16:57:56 +00:00
Wietze
6793a7d238 Fixing various issues identified 2021-12-14 16:50:22 +00:00
Wietze
adf171d089 Applying minor format changes (incorrectly formatted dates, typos, etc.) 2021-12-14 15:53:03 +00:00
Wietze
754a451e76 Updating entries that have been confirmed to be working on Windows 11 (21H2) 2021-12-14 15:51:43 +00:00
Wietze
39d4e815af Minor formatting changes (redudant backslashes, incorrect dates, typos, etc.) 2021-12-14 14:57:32 +00:00
whickey-r7
18bceb7639 Create Unregmp2.yml 
Added a new lolbin, unregmp2.exe, used for proxying execution.
 2021-12-06 12:13:24 -05:00
frack113
17899acbb0 Adding Sigma references to ConfigSecurityPolicy, Diantz, ExtExport & Extrac32 (#184) 2021-12-06 11:19:01 +00:00
frack113
2d28767c04 Adding new Sigma references (AppInstaller, AspnetCompiler, Bash, Certreq) (#183) 2021-11-25 09:42:26 +00:00
Wietze
f7b30775a4 Odbcconf realign to T1218.008, hh.exe to T1218.001 2021-11-16 14:09:37 +00:00