From d6e4fb07d5649ee4ca1f42839f95a50213bb7870 Mon Sep 17 00:00:00 2001 From: Manas Bellani Date: Thu, 5 Oct 2023 00:47:18 +1100 Subject: [PATCH] Added lolbas iediagcmd.exe as discovered by Adam @hexacorn (#199) Everything looks good, confirmed working on Windows 10 & 11, merging changes: * Added 'Execute' lolbas for iediagcmd.exe * Added missing fields from the template * Update Iediagcmd.yml Made corrections * Update Iediagcmd.yml Removing trailing spaces * Update Iediagcmd.yml removing empty fields * Minor changes * Update Iediagcmd.yml Removing space before first "&". When setting the Environment variable, it's picking up the space so the path seemed to be "c:\test \", which is why tests are failing. * Adding Windows 11 support --------- Co-authored-by: Conor Richard Co-authored-by: Wietze --- yml/OSBinaries/Iediagcmd.yml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 yml/OSBinaries/Iediagcmd.yml diff --git a/yml/OSBinaries/Iediagcmd.yml b/yml/OSBinaries/Iediagcmd.yml new file mode 100644 index 0000000..b1d47d4 --- /dev/null +++ b/yml/OSBinaries/Iediagcmd.yml @@ -0,0 +1,24 @@ +--- +Name: iediagcmd.exe +Description: Diagnostics Utility for Internet Explorer +Author: manasmbellani +Created: 2022-03-29 +Commands: + - Command: 'set windir=c:\test& cd "C:\Program Files\Internet Explorer\" & iediagcmd.exe /out:c:\test\foo.cab' + Description: Executes binary that is pre-planted at C:\test\system32\netsh.exe. + Usecase: Spawn a pre-planted executable from iediagcmd.exe. + Category: Execute + Privileges: User + MitreID: T1218 + OperatingSystem: Windows 10 1803, Windows 10 1703, Windows 10 22H1, Windows 10 22H2, Windows 11 +Full_Path: + - Path: C:\Program Files\Internet Explorer\iediagcmd.exe +Detection: + - Sigma: https://github.com/manasmbellani/mycode_public/blob/master/sigma/rules/win_proc_creation_lolbin_iediagcmd.yml + - IOC: Sysmon Event ID 1 + - IOC: Execution of process iediagcmd.exe with /out could be suspicious +Resources: + - Link: https://twitter.com/Hexacorn/status/1507516393859731456 +Acknowledgement: + - Person: Adam + Handle: '@hexacorn'