Josh Rickard
a5dd0813cd
* fix: Updating atomics YAML file structure to align with the new JSON schema definition. This also fixes some white space issues and general line formatting across all impacted atomics. * fix: One additional change needed --------- Co-authored-by: MSAdministrator <MSAdministrator@users.noreply.github.com> Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
61 lines
2.2 KiB
YAML
61 lines
2.2 KiB
YAML
attack_technique: T1202
|
|
display_name: Indirect Command Execution
|
|
atomic_tests:
|
|
- name: Indirect Command Execution - pcalua.exe
|
|
auto_generated_guid: cecfea7a-5f03-4cdd-8bc8-6f7c22862440
|
|
description: |
|
|
The Program Compatibility Assistant (pcalua.exe) may invoke the execution of programs and commands from a Command-Line Interface.
|
|
[Reference](https://twitter.com/KyleHanslovan/status/912659279806640128)
|
|
Upon execution, calc.exe should open
|
|
supported_platforms:
|
|
- windows
|
|
input_arguments:
|
|
payload_path:
|
|
description: Path to payload
|
|
type: path
|
|
default: C:\Windows\System32\calc.exe
|
|
process:
|
|
description: Process to execute
|
|
type: string
|
|
default: calc.exe
|
|
executor:
|
|
command: |
|
|
pcalua.exe -a #{process}
|
|
pcalua.exe -a #{payload_path}
|
|
name: command_prompt
|
|
- name: Indirect Command Execution - forfiles.exe
|
|
auto_generated_guid: 8b34a448-40d9-4fc3-a8c8-4bb286faf7dc
|
|
description: |
|
|
forfiles.exe may invoke the execution of programs and commands from a Command-Line Interface.
|
|
[Reference](https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Forfiles.yml)
|
|
"This is basically saying for each occurrence of notepad.exe in c:\windows\system32 run calc.exe"
|
|
Upon execution calc.exe will be opened.
|
|
supported_platforms:
|
|
- windows
|
|
input_arguments:
|
|
process:
|
|
description: Process to execute
|
|
type: string
|
|
default: calc.exe
|
|
executor:
|
|
command: |
|
|
forfiles /p c:\windows\system32 /m notepad.exe /c #{process}
|
|
name: command_prompt
|
|
- name: Indirect Command Execution - conhost.exe
|
|
auto_generated_guid: cf3391e0-b482-4b02-87fc-ca8362269b29
|
|
description: |
|
|
conhost.exe refers to a host process for the console window. It provide an interface between command prompt and Windows explorer.
|
|
Executing it through command line can create process ancestry anomalies
|
|
[Reference] (http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/)
|
|
supported_platforms:
|
|
- windows
|
|
input_arguments:
|
|
process:
|
|
description: Process to execute
|
|
type: string
|
|
default: notepad.exe
|
|
executor:
|
|
command: |
|
|
conhost.exe "#{process}"
|
|
name: command_prompt
|