Added certutil rename

Reference: https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html https://twitter.com/ItsReallyNick/status/1040402921777782784
2018-09-14 08:34:29 -05:00
parent 4f31d6ac09
commit 52ca3f8b1b
1 changed files with 19 additions and 0 deletions
@@ -21,3 +21,22 @@ atomic_tests:
    command: |
      certutil.exe -encode #{executable} file.txt
      certutil.exe -decode file.txt #{executable}
+
+- name: Certutil Rename and Decode
+  description: |
+    Rename certutil and decode a file. This is in reference to latest research by FireEye [here](https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html)
+
+  supported_platforms:
+    - windows
+
+  input_arguments:
+    executable:
+      description: name of executable/file to decode
+      type: path
+      default: c:\file.exe
+
+  executor:
+    name: command_prompt
+    command: |
+      cmd.exe /c copy %windir%\\system32\\certutil.exe %temp%tcm.tmp
+      cmd.exe /c %temp%tcm.tmp -decode #{executable}