LOL_BINs

Enabling Dev Drive With Disabled AV

Nov 29, 2023 · attack.defense.evasion attack.T1562.001 ·

Detects the execution of fsutil.exe to enable a Dev Drive with an argument that disables the AV on the created drive. This technique is available starting with Windows 11.

Disabled AV On Dev Drive via Registry

Nov 5, 2023 · attack.defense.evasion attack.T1562.001 ·

Share on:

Detects the execution registry change that enables a Dev Drive without allowing AV to access the created drive. This technique is available starting with Windows 11.

Execute Python Scripts via Python Installer Binary

Oct 26, 2023 · attack.Defense.Evasion attack.T1202 ·

Share on:

Detects the execution of malicious Python scripts from the AppData directory after the execution of the setup.exe installation package. Some installation packages allow for post-installation scripts to be run. A malicious actor could modify these scripts or add their own to execute malicious actions after the legitimate software is installed.

Extract Credentials From IIS Application Pool Configuration Files

Sep 13, 2023 · attack.CredentialAccess attack.T1552.001 ·

Share on:

Detects the execution of appcmd.exe that is used to extract credentials from configuration files. IIS application pools can run as different users for security and isolation purposes. When a user is specified for the application pool, their credentials are stored in plaintext in the configuration file.

CMSTP can be used to install .inf malicious code to run pre-installation

Aug 10, 2023 · attack.Defense Evasion attack.T1218 ·

Share on:

Detects the execution of CMSTP that is used install fake Connection Manager Profiles via contains via .INF files that resign on a temp location on disk and contains instructions for how the Connection Manager should install the profile. The .INF files could contain malicious code under the section RunPreSetupCommandsSection which is the commands to run before setup.

Wrmgr.exe spawning without command line arguments

Sep 14, 2022 · attack.Defense Evasion attack.T1218 ·

Share on:

Wrmgr.exe should not spawn without any command line arguments. Sometimes malware are using process injection to masquerade their malicious activities and evade detection.

Dumpbin LOLBin use for proxying execution via link.exe

Aug 25, 2022 · attack.Defense Evasion attack.T1218 ·

Share on:

Using dumpbin.exe, a windows binary that is installed along side visual studio versions. When dumbin.exe is executed, it is calling link.exe without checking the legitimacy of the link.exe named binary in the same directory.

MSTeams exe side-loading - Update.exe

Apr 25, 2022 · attack.Defense Evasion attack.T1218 ·

Share on:

Detects execution of side-loaded executable via the update.exe, part microsoft teams' application binary.