Hare Sudhan
c8a70997da
* Update T1202.yaml * fix all atomics * changing to macos to fix pytest issue * changing to macos to fix pytest issue * adding gitignore
79 lines
2.8 KiB
YAML
79 lines
2.8 KiB
YAML
attack_technique: T1202
|
|
display_name: Indirect Command Execution
|
|
atomic_tests:
|
|
- name: Indirect Command Execution - pcalua.exe
|
|
auto_generated_guid: cecfea7a-5f03-4cdd-8bc8-6f7c22862440
|
|
description: |
|
|
The Program Compatibility Assistant (pcalua.exe) may invoke the execution of programs and commands from a Command-Line Interface.
|
|
[Reference](https://twitter.com/KyleHanslovan/status/912659279806640128)
|
|
Upon execution, calc.exe should open
|
|
supported_platforms:
|
|
- windows
|
|
input_arguments:
|
|
payload_path:
|
|
description: Path to payload
|
|
type: path
|
|
default: C:\Windows\System32\calc.exe
|
|
process:
|
|
description: Process to execute
|
|
type: string
|
|
default: calc.exe
|
|
executor:
|
|
command: |
|
|
pcalua.exe -a #{process}
|
|
pcalua.exe -a #{payload_path}
|
|
name: command_prompt
|
|
- name: Indirect Command Execution - forfiles.exe
|
|
auto_generated_guid: 8b34a448-40d9-4fc3-a8c8-4bb286faf7dc
|
|
description: |
|
|
forfiles.exe may invoke the execution of programs and commands from a Command-Line Interface.
|
|
[Reference](https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Forfiles.yml)
|
|
"This is basically saying for each occurrence of notepad.exe in c:\windows\system32 run calc.exe"
|
|
Upon execution calc.exe will be opened.
|
|
supported_platforms:
|
|
- windows
|
|
input_arguments:
|
|
process:
|
|
description: Process to execute
|
|
type: string
|
|
default: calc.exe
|
|
executor:
|
|
command: |
|
|
forfiles /p c:\windows\system32 /m notepad.exe /c #{process}
|
|
name: command_prompt
|
|
- name: Indirect Command Execution - conhost.exe
|
|
auto_generated_guid: cf3391e0-b482-4b02-87fc-ca8362269b29
|
|
description: |
|
|
conhost.exe refers to a host process for the console window. It provide an interface between command prompt and Windows explorer.
|
|
Executing it through command line can create process ancestry anomalies
|
|
[Reference] (http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/)
|
|
supported_platforms:
|
|
- windows
|
|
input_arguments:
|
|
process:
|
|
description: Process to execute
|
|
type: string
|
|
default: notepad.exe
|
|
executor:
|
|
command: |
|
|
conhost.exe "#{process}"
|
|
name: command_prompt
|
|
- name: Indirect Command Execution - Scriptrunner.exe
|
|
auto_generated_guid: 0fd14730-6226-4f5e-8d67-43c65f1be940
|
|
description: |-
|
|
The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting. Upon test execution, calc.exe should open
|
|
Reference: https://x.com/NickTyrer/status/914234924655312896
|
|
supported_platforms:
|
|
- windows
|
|
input_arguments:
|
|
payload_path:
|
|
description: Path to the executable
|
|
type: String
|
|
default: C:\Windows\System32\calc.exe
|
|
executor:
|
|
command: Scriptrunner.exe -appvscript "#{payload_path}"
|
|
cleanup_command:
|
|
name: powershell
|
|
elevation_required: false
|
|
|