mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2026-08-02 00:04:08 +02:00
35 lines
1.7 KiB
YAML
35 lines
1.7 KiB
YAML
---
|
|
Name: Mofcomp.exe
|
|
Description: Compiler that parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Threat actors can leverage this binary to install malicious MOF scripts
|
|
Author: Daniel Gott
|
|
Created: 2022-07-19
|
|
Commands:
|
|
- Command: mofcomp.exe {PATH_ABSOLUTE:.mof}
|
|
Description: Abuse of mofcomp.exe to parse a file which contains MOF statements in order create new classes as part of the WMI repository
|
|
Usecase: Threat actors can use mofcomp.exe to register a malicious MOF file as a new class in the WMI repository
|
|
Category: Execute
|
|
Privileges: User
|
|
MitreID: T1047
|
|
OperatingSystem: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11, Windows Server 2008+
|
|
Tags:
|
|
- Execute: MOF
|
|
Full_Path:
|
|
- Path: C:\Windows\System32\wbem\mofcomp.exe
|
|
- Path: C:\Windows\SysWOW64\wbem\mofcomp.exe
|
|
Detection:
|
|
- IOC: strange parent processes spawning mofcomp.exe like cmd.exe or powershell.exe
|
|
- Sigma: https://github.com/The-DFIR-Report/Sigma-Rules/blob/75260568a7ffe61b2458ca05f6f25914efb44337/win_mofcomp_execution.yml
|
|
Resources:
|
|
- Link: https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp
|
|
- Link: https://docs.microsoft.com/en-us/windows/win32/wmisdk/managed-object-format--mof-
|
|
- Link: https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
|
|
- Link: https://in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
|
|
- Link: https://medium.com/threatpunter/detecting-removing-wmi-persistence-60ccbb7dff96
|
|
Acknowledgement:
|
|
- Person: Daniel Gott
|
|
Handle: '@gott_cyber'
|
|
- Person: The DFIR Report
|
|
Handle: '@TheDFIRReport'
|
|
- Person: Nasreddine Bencherchali
|
|
Handle: '@nas_bench'
|