Files

T

Michael Haag 66c37e8b53 Evasion and exfil

+ Added wevtutil and fsutil per what was used recently by BadBuddy Ransomware.
+ Added 2 ways to compress data with Powershell and rar.

2017-10-31 12:56:52 -07:00

File Deletion

MITRE ATT&CK Technique: T1002

PowerShell

powershell.exe dir c:\* -Recurse | Compress-Archive -DestinationPath C:\test\Data.zip

rar a -r exfilthis.rar *.docx