2020-10-07 22:49:12 +03:00
|
|
|
title: Custom Class Execution via Xwizard
|
|
|
|
|
id: 53d4bb30-3f36-4e8a-b078-69d36c4a79ff
|
2021-11-27 11:33:14 +01:00
|
|
|
status: test
|
2020-10-07 22:49:12 +03:00
|
|
|
description: Detects the execution of Xwizard tool with specific arguments which utilized to run custom class properties.
|
2021-11-27 11:33:14 +01:00
|
|
|
author: 'Ensar Şamil, @sblmsrsn, @oscd_initiative'
|
2020-10-07 22:49:12 +03:00
|
|
|
references:
|
2021-11-27 11:33:14 +01:00
|
|
|
- https://lolbas-project.github.io/lolbas/Binaries/Xwizard/
|
2020-10-07 22:49:12 +03:00
|
|
|
date: 2020/10/07
|
2021-11-27 11:33:14 +01:00
|
|
|
modified: 2021/11/27
|
2020-10-07 22:49:12 +03:00
|
|
|
logsource:
|
2021-11-27 11:33:14 +01:00
|
|
|
category: process_creation
|
|
|
|
|
product: windows
|
2020-10-07 22:49:12 +03:00
|
|
|
detection:
|
2021-11-27 11:33:14 +01:00
|
|
|
selection:
|
|
|
|
|
Image|endswith: '\xwizard.exe'
|
|
|
|
|
CommandLine|re: '{[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}}'
|
|
|
|
|
condition: selection
|
2020-10-07 22:49:12 +03:00
|
|
|
falsepositives:
|
2021-11-27 11:33:14 +01:00
|
|
|
- Unknown
|
2020-10-09 09:38:14 +03:00
|
|
|
level: medium
|
2021-11-27 11:33:14 +01:00
|
|
|
tags:
|
|
|
|
|
- attack.defense_evasion
|
|
|
|
|
- attack.t1218
|
