Oddvar Moe
394d3c66f9
Merge pull request #112 from zeroSteiner/patch-1
...
Update the affected operating systems for SyncAppvPublishingServer
2021-01-21 22:35:50 +01:00
Oddvar Moe
e9e458d6b7
Merge pull request #111 from michalani/patch-1
...
Addded missing path for winword.exe
2021-01-21 22:32:24 +01:00
Oddvar Moe
97176a0a07
Merge pull request #110 from whickey-r7/patch-2
...
Create AppInstaller.yml
2021-01-21 22:29:35 +01:00
Oddvar Moe
6774d228a5
Merge pull request #109 from unexpectedBy/patch-2
...
Create DataSvcUtil.yml
2021-01-21 22:24:02 +01:00
Oddvar Moe
1bf91d246a
Merge pull request #107 from nasbench/adding-dllhost-lolbin
...
Create Dllhost.yml
2021-01-21 22:20:03 +01:00
wokis
00935f154e
Update Wsreset.yml
...
Added detection by Microsoft Defender Antivirus as Behavior:Win32/UACBypassExp.T!gen
2021-01-20 14:47:23 +01:00
Wietze
2e08819eef
Fix Usecase field
2021-01-10 15:54:00 +00:00
Wietze
5012f95152
Fix Code_Sample field
2021-01-10 15:49:30 +00:00
Wietze
fc223eb3d8
Remove/fix unnecessary Categories field
2021-01-10 15:48:20 +00:00
Wietze
5ec4de562b
Fixed acknowledgements
2021-01-10 15:45:25 +00:00
Wietze
38f9a0a032
Fixed incorrect MItreLink
2021-01-10 15:26:27 +00:00
Wietze
14dca38278
Standardise date formats (see https://yaml.org/type/timestamp.html )
2021-01-10 15:04:52 +00:00
Wietze
de50a47957
Fix invalid YAML
2021-01-10 14:46:36 +00:00
Ahmad AS
be69f54245
Update Adplus.yml
2021-01-09 03:00:05 -05:00
ahmad
080fe4ca5b
Create Adplus.yml
2021-01-09 02:56:32 -05:00
Ahmad AS
4254927f78
Update Remote.yml
2021-01-06 23:31:01 -05:00
ahmad
7dab1b916e
Create remote.yml
2021-01-06 20:48:25 -05:00
LuxNoBu!!shit
0d819439c5
Create pnputil.exe
2020-12-25 12:14:15 -08:00
Spencer McIntyre
deb249042b
Update the affected operating systems for SyncAppvPublishingServer
2020-12-08 15:32:35 -05:00
michalani
36b28ddd98
Update Winword.yml
2020-12-03 01:03:08 +00:00
whickey-r7
b381d04faf
Create AppInstaller.yml
...
New lolbin for downloading files in Windows 10.
2020-12-02 11:35:49 -05:00
unload
bfe248b07e
Create DataSvcUtil.yml
...
Another data exfil way with lolbins
2020-12-01 22:57:09 -03:00
Nasreddine Bencherchali
15d5ff302d
Create Dllhost.yml
2020-11-07 14:22:24 +01:00
jesgal
483482e3a3
Create Upload.yml
...
File describing the execution of LolBin Update.exe deployed with the installation of Whatsapp on Windows operating systems.
2020-11-01 20:09:41 +01:00
jesgal
4c67be51c1
Delete Update.yml
2020-11-01 20:05:25 +01:00
jesgal
748cfb4223
Merge pull request #2 from jesgal/jesgal-persistence-update
...
Update Update.yml
2020-11-01 19:53:13 +01:00
jesgal
31c7d34a00
Create Update.yml
...
This file describes LoLbin Update.exe deployed in the Whatsapp installation for Windows Operating Systems.
2020-11-01 19:50:59 +01:00
jesgal
9642f81be7
Update Update.yml
...
I update this LolBin to create persistence of payload.exe in the directory "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup" by running payload.exe with the argument "--createShortcut" and "--removeShortcut".
2020-10-29 09:12:28 +01:00
Conor Richard
d15172284a
Merge pull request #101 from leo1-1/master
...
added command to certutil
2020-10-26 19:44:53 -04:00
Conor Richard
5806d33e70
Update Certutil.yml
2020-10-26 19:43:55 -04:00
leo1-1
64d5dffc4b
Delete certutil.yml
2020-10-26 08:59:00 +02:00
leo1-1
76d79ea479
Update Certutil
2020-10-26 08:57:42 +02:00
leo1-1
2166960d4e
changed path
2020-10-26 08:22:58 +02:00
Conor Richard
9a83179ddd
Merge pull request #99 from dtmsecurity/master
...
Create Wuauclt.yml
2020-10-24 22:29:34 -04:00
Conor Richard
edbd01860c
Merge pull request #97 from MartinSohn/master
...
Create Coregen.yml - Thank you for the contribution!
2020-10-24 21:49:09 -04:00
Conor Richard
04c0e7ee38
Update Explorer.yml
...
Fixing alignment in Acknowledgement section
2020-10-22 22:00:05 -04:00
xenoscr
de169664d6
Finxing missing quotes
2020-10-22 21:51:57 -04:00
Conor Richard
b61cd18072
Merge pull request #94 from checkymander/master
...
Create DefaultPack.yml
2020-10-22 21:19:50 -04:00
Conor Richard
4f19dbba19
Merge pull request #93 from C3dr1cMFE/add_MpCmdRun_Bypass
...
Update MpCmdRun.yml
2020-10-22 21:05:37 -04:00
Conor Richard
d281faccd3
Merge pull request #92 from whickey-r7/patch-1
...
Update Xwizard.yml
2020-10-22 20:57:55 -04:00
Conor Richard
9a6309d8de
Update ConfigSecurityPolicy.yml
...
Added link to Tweet from author containing an example usage.
2020-10-22 20:38:50 -04:00
@dtmsecurity
651e156583
Create Wuauclt.yml
2020-10-12 19:24:45 +01:00
Martin
47c03c97b8
Typo
2020-10-10 19:54:50 +00:00
Martin
22d9bbe92a
Initial commit of Coregen.yml
2020-10-09 17:10:49 +02:00
checkymander
a45d4ca25c
Create DefaultPack.yml
...
Added DefaultPack.EXE LOLBin
2020-10-01 22:37:00 -04:00
Cochin, Cedric
13026a481b
Update MpCmdRun.yml
...
DownloadFile option has been removed from current MpCmdRun.exe, but old binary remains on disk. Defender cmd line mitigation can be bypassed by simply renaming the binary in a folder controlled by the attacker
2020-09-24 14:09:58 -07:00
whickey-r7
11aa1e503b
Update Xwizard.yml
...
This lolbin has functionality which allows downloading of files from the internet as well as previously outlined execution functionality.
2020-09-16 16:34:47 +00:00
unload
6a5af9a71c
Create ConfigSecurityPolicy.yml
2020-09-04 07:54:44 -03:00
Rich Rumble
1b00b374b3
Updated per suggestion
...
Thanks!
2020-09-03 11:46:25 -04:00
Rich Rumble
3078cc3755
Update MpCmdRun.yml
...
Added note that slashes (/) can also be used as command separators, and that the UA is MpCommunication
Thanks!
2020-09-03 10:39:24 -04:00
Oddvar Moe
63c9bc97c3
Added detection details on mpcmdrun
2020-09-03 15:29:32 +02:00
Oddvar Moe
5c5a218faf
Updated links on mpcmdrun
2020-09-03 11:00:56 +02:00
Oddvar Moe
bfccb51085
Added MpCmdRun.exe
2020-09-03 10:55:37 +02:00
Oddvar Moe
9a5e2b114f
Fixed the OS versions on Diantz
2020-09-03 10:28:49 +02:00
Oddvar Moe
38a3d406b0
Update and rename pktmon.yml to Pktmon.yml
2020-08-24 09:51:48 +02:00
Oddvar Moe
2bb6404160
Merge pull request #82 from binar-x79/patch-1
...
Create pktmon.yml
2020-08-24 09:49:44 +02:00
Oddvar Moe
525fc0c1eb
Added missing ticks in Diantz
2020-08-24 09:48:07 +02:00
Oddvar Moe
9b290ba808
Update and rename diantz.yml to Diantz.yml
2020-08-24 09:46:09 +02:00
Oddvar Moe
48219b177f
Merge pull request #80 from Tamirye/master
...
Create diantz.yml
2020-08-24 09:45:12 +02:00
Oddvar Moe
c5c6820c56
Rename agentexecutor.yml to Agentexecutor.yml
2020-08-24 09:42:07 +02:00
Oddvar Moe
a7da0deddd
Merge pull request #77 from leftp/master
...
Added method for AgentExecutor
2020-08-24 09:41:22 +02:00
Oddvar Moe
57346d17f4
Changed capitalization inside file
2020-08-24 09:34:56 +02:00
Oddvar Moe
4792d22ddd
Rename vbc.yml to Vbc.yml
2020-08-24 09:33:37 +02:00
Oddvar Moe
380b8cfecd
Rename ilasm.yml to Ilasm.yml
2020-08-24 09:33:22 +02:00
Oddvar Moe
fa3710ede5
Rename certreq.yml to Certreq.yml
2020-08-24 09:32:54 +02:00
Oddvar Moe
a104fbd075
Merge pull request #75 from dtmsecurity/master
...
Create certreq.yml
2020-08-24 09:30:16 +02:00
Oddvar Moe
2cf7d8cdeb
Adjusted missing ticks in Acknowledgement
2020-08-24 09:28:38 +02:00
Oddvar Moe
84a6cd8e85
Merge pull request #66 from GoSecure/gosecure/ttdinject
...
Added proxy execution for ttdinject.exe
2020-08-24 09:25:29 +02:00
Oddvar Moe
8cf6ef53fb
Rename squirrel.yml to Squirrel.yml
2020-08-15 00:27:11 +02:00
Oddvar Moe
39f55359ef
Rename update.yml to Update.yml
2020-08-15 00:26:53 +02:00
Oddvar Moe
020416d098
Delete Update.yml
2020-08-15 00:26:35 +02:00
Oddvar Moe
4c44d039a1
Merge pull request #81 from jreegun/patch-6
...
Update update.yml
2020-08-15 00:24:45 +02:00
Oddvar Moe
b592be6027
Update Manage-bde.yml
...
Remove extra -
2020-08-15 00:17:27 +02:00
Oddvar Moe
2dabdb0840
adjusted extrac32 yml error
2020-08-15 00:13:16 +02:00
Oddvar Moe
a24bc5b946
Merge pull request #79 from LuxNoBulIshit/master
...
add new usecase for Extrace32.exe
2020-08-15 00:05:37 +02:00
Oddvar Moe
631996950a
Update Extrac32.yml
2020-08-15 00:05:16 +02:00
binar-x79
eb0279838b
Create pktmon.yml
2020-08-12 22:04:03 -07:00
Reegun J
ed1e113460
Update update.yml
...
Hi, I have updated with new findings - Reegun
2020-08-10 11:31:48 +08:00
Tamirye
4db780e0f0
Create diantz.yml
...
use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream.
2020-08-08 15:09:53 +03:00
LuxNoBu!!shit
be19ca53ed
Update Extrac32.yml
2020-08-08 15:02:05 +03:00
LuxNoBu!!shit
2450b9fc0a
Update Extrac32.yml
2020-08-08 15:01:46 +03:00
LuxNoBu!!shit
3a3d28e496
Update Extrac32.yml
...
another use case for extrace32.
2020-08-08 14:59:15 +03:00
Chris "Lopi" Spehn
689c3b1fea
Update Regsvcs.yml
...
Fixed inaccurate permissions
2020-08-04 07:40:48 -06:00
Eleftherios Panos
3710c1c972
Added method for AgentExecutor
2020-07-23 13:58:30 +03:00
@dtmsecurity
aa88bf8144
Create certreq.yml
2020-07-07 21:09:06 +01:00
Maxime Nadeau
640e7f2d65
Added a Windows 10 2004 version
2020-07-03 16:59:53 -04:00
bohops
343a0e2478
Added plain explorer execution
2020-07-03 15:03:07 -04:00
bohops
92f020b885
Added dotnet msbuild awl bypass technique
2020-07-03 14:56:06 -04:00
bohops
a976eaefe1
Updated Mitre Reference - T1096
2020-07-03 10:35:01 -04:00
bohops
f1a7ad92dd
Changed privilege level for registration
2020-07-03 10:24:34 -04:00
bohops
e316cb4842
Delete Slmgr - COM Hijacks are too broad
2020-07-03 10:15:06 -04:00
bohops
12cdb47285
Removed COM Hijack
2020-07-03 10:07:18 -04:00
bohops
17a34e27f6
Added Twitter reference for use "in-the-wild"
2020-07-03 10:03:42 -04:00
Oddvar Moe
cb3a45008e
Added regini.exe writing to registry using ADS
2020-07-03 15:40:58 +02:00
Oddvar Moe
420860e5f7
Adjusted some missing quotes and stuff on Dekstopimgdownldr
2020-07-03 15:05:33 +02:00
Oddvar Moe
7dfbc7af67
Update and rename desktopimgdownldr.yml to Desktopimgdownldr.yml
...
Changed capitalization
2020-07-03 15:04:09 +02:00
Oddvar Moe
c5866efc41
Merge pull request #74 from Kristal-g/master
...
Added desktopimgdownldr.exe
2020-07-03 15:03:10 +02:00
Oddvar Moe
dac58c312f
Fixed some missing quotes and stuff on psr.exe
2020-07-03 14:59:50 +02:00
Oddvar Moe
17db28c643
Merge pull request #73 from Lemonada/master
...
Add psr.exe
2020-07-03 14:58:26 +02:00
Oddvar Moe
416680941d
Rename explorer.yml to Explorer.yml
...
Changed capitalization
2020-07-03 14:52:29 +02:00
Oddvar Moe
8bb57e1ac5
Merge pull request #72 from JPMinty/master
...
Create explorer.yml
2020-07-03 14:50:07 +02:00
Oddvar Moe
c31053e6bd
Merge pull request #70 from cnotin/patch-1
...
sqldumper: minor fix mis-typed words
2020-07-03 14:34:02 +02:00
Oddvar Moe
8ce4c1497d
Merge pull request #64 from noraj/patch-1
...
Download for ftp.exe
2020-07-03 14:08:32 +02:00
Oddvar Moe
794d3c04cc
Added Acknowledgement to rundll32
2020-07-03 14:03:51 +02:00
Oddvar Moe
604eb45fb4
Merge pull request #61 from MartinIngesen/master
...
Using rundll32 to execute dll from a SMB share
2020-07-03 14:01:12 +02:00
Kristal-g
fd01a9151a
Added desktopimgdownldr.exe
2020-07-02 20:46:05 +03:00
Lemonada
2a5a4e391d
Create Psr.yml
...
take screenshots of user sessions
2020-06-27 14:51:07 +03:00
JPMinty
663724523f
Update explorer.yml
2020-06-24 21:15:40 +09:30
JPMinty
dec26ada21
Create explorer.yml
2020-06-24 21:09:59 +09:30
Clément Notin
ae3d9b9b6b
sqldumper: minor fix mis-typed words
2020-06-15 23:33:34 +02:00
Maxime Nadeau
b95fb7ed27
Added the IOCs
2020-05-12 16:40:49 -04:00
Maxime Nadeau
b8b265b397
Added ttdinject
2020-05-12 16:31:47 -04:00
Maxime Nadeau
5de8d357b6
Added ttdinject.exe
2020-05-12 16:24:49 -04:00
Alexandre ZANNI
aef4b06952
Download for ftp.exe
...
add a non-interactive one-line command to download arbitrary binary with ftp.exe
excessively useful on Windows XP, & Windows Server 2003 where all other LOLBAS that allow download (certutils, bitsutils, etc.) don't exist and where powershell was not install by default.
2020-04-21 23:52:22 +02:00
Oddvar Moe
9722cceb9e
Added download example to wsl.exe
2020-03-25 11:33:02 +01:00
Oddvar Moe
9f110bce07
Fixed missing octet in command
2020-03-25 11:24:54 +01:00
Oddvar Moe
6ac04d73d7
Added examples to bash.exe
2020-03-25 11:08:13 +01:00
Oddvar Moe
f2fa2ef989
Added additional example to wsl.exe
2020-03-25 10:26:59 +01:00
Chris "Lopi" Spehn
d67c8f5c11
Update RegAsm to the correct permissions
2020-03-20 11:51:21 -06:00
Martin Ingesen
e4face79af
Using rundll32 to execute dll via SMB
2020-03-18 15:20:50 +01:00
Oddvar Moe
cce7c5ce3a
Adjusted error in atbroker as per issue #47
2020-03-17 11:08:47 +01:00
Oddvar Moe
94d10799d3
Adjusted ilasm
2020-03-17 11:05:14 +01:00
Oddvar Moe
187786469c
Merge pull request #60 from LuxNoBulIshit/master
...
Create ilasm.yml
2020-03-17 10:57:53 +01:00
Oddvar Moe
dc3a211c89
Re-added ntdsutil
2020-03-17 10:55:59 +01:00
LuxNoBu!!shit
7a2ff4c250
Create ilasm.yml
2020-03-17 03:04:20 +02:00
Oddvar Moe
4bef10b147
adjusted rasautou and removed ntdsutil
2020-03-16 20:10:17 +01:00
Oddvar Moe
80295ef865
Merge pull request #54 from ForensicITGuy/ntdsutil
...
Ntdsutil & Rasautou addition
2020-03-16 20:06:54 +01:00
Oddvar Moe
81c363ac8a
Adjustment to vbc.yml contribution
2020-03-16 19:55:27 +01:00
leo1-1
c7c93e9f95
Create vbc.yml
2020-02-27 17:13:07 +02:00
Oddvar Moe
acecdcf3df
Netsh contribution from Freddie Bar-Smith - Thank you
2020-01-23 09:07:40 +01:00
Oddvar Moe
94708ac5d6
Added links to obfuscation technique from Sailay(valen) on rundll32
2020-01-23 08:57:43 +01:00
Tony M Lambert
e2f217c777
ntdsutil addition
2020-01-10 22:53:34 -06:00
Tony M Lambert
99b87fdc13
Rasautou addition
2020-01-10 22:52:15 -06:00
Oddvar Moe
ecc94c2d09
Adjusted GfxDownloadWrapper
2020-01-07 09:08:13 +01:00
Oddvar Moe
71aec7465b
Minor adjustments to GfxDownloadWrapper.yml
2020-01-07 09:03:42 +01:00
Oddvar Moe
aada926e6f
Merge pull request #52 from jesgal/patch-1
...
Create GfxDownloadWrapper.yml
2020-01-07 09:00:58 +01:00
Oddvar Moe
22ef6bfc63
Added additional paths to CL_MutexVerifiers.ps1 - input from @shilpeshTrivedi
2020-01-07 08:45:25 +01:00
Oddvar Moe
7030e00929
Capitalized dotnet name
2020-01-07 08:40:24 +01:00
Oddvar Moe
e1b36a25bd
Rename dotnet.yml to Dotnet.yml
2020-01-07 08:37:36 +01:00
Oddvar Moe
acd38cec9e
Merge pull request #49 from felamos/master
...
Create dotnet.yml
2020-01-07 08:32:35 +01:00
jesgal
c9e608ce0f
Update GfxDownloadWrapper.yml
2019-12-27 17:11:30 +01:00
jesgal
a057cf2420
Create GfxDownloadWrapper.yml
...
GfxDownloadWrapper.exe downloads the content that returns <URL> and writes it to the file <DESTINATION FILE PATH>. The binary is signed by "Microsoft Windows Hardware", "Compatibility Publisher", "Microsoft Windows Third Party Component CA 2012", "Microsoft Time-Stamp PCA 2010", "Microsoft Time-Stamp Service".
2019-12-27 17:02:34 +01:00
Ayush Sahay
5cb17cfb26
Create dotnet.yml
2019-12-11 15:53:12 +05:30
Oddvar Moe
94a295213e
Added Dump example to TTTracer.exe
2019-11-18 12:50:49 +01:00
Oddvar Moe
e0db5721ff
Added Dump Example to TTTracer.exe
2019-11-18 12:47:51 +01:00
Oddvar Moe
4663c13324
Adjustment
2019-11-05 15:47:20 +01:00
Oddvar Moe
8d74b3062f
Adjustment
2019-11-05 14:36:53 +01:00
Oddvar Moe
f9a7c42a85
Added TTTracer.exe - Thanks Onur Ulusoy
2019-11-05 12:12:46 +01:00
Oddvar Moe
13093c879e
Updated odbcconf.exe with discovery from @Hexacorn <3
2019-10-24 10:01:44 +02:00
Oddvar Moe
cb9fa974dd
Merge pull request #46 from felamos/patch-1
...
Create devtoolslauncher.yml
2019-10-07 23:56:01 +02:00
