Lolbin

For those who don’t know, LetsDefend is a plataform where, among other things, simulates a SOC and there are some alerts to be resolved. …

Introduction Continuing with the same idea as my last two articles about “F-Secure FSDIAG” and “CyberGhost VPN”, let’s continue our search for LOLBINs in known products. This time I’m taking a look at 360 Total Security Note: This issue has been reported to the 360 Total Security team but no response…

Introduction In the same spirit as my last article about “F-Secure FSDIAG”, let’s continue our search for LOLBINs in known products. This time I’m taking a look at CyberGhost VPN Note: Since the CyberGhost team doesn’t have a vulnerability program, I’ve reported this issue to the support team which they forwarded…

Introduction I’ve been doing some “stupid research” recently on a lot of tools in my quest to find LOLBins everywhere. This short blog is about one of those tools called “fsdiag.exe”. Note: This issue has been reported at the start of the year in January 2022 and has been fixed in…

Introduction While working on “Malicious Command-Line”(MAL-CL), documenting and researching the many use cases different tools can be (ab)used via the command line. I noticed a trend that in hindsight seems “obviously obvious” but is I believe worth saying nonetheless. You don’t drop things just because they’re old and dusty, you drop…

What is cmdl32.exe? cmdl32.exe is legitimate file. This process is associated with Microsoft connection Manager Auto-Download and this application is used by Microsoft(R) Connection Manager. This legitimate file can be abused — Great finding by Elliot Killick where this lolbin could be used in order to get under radar downloading #mimikatz and other suspicious payloads. This is posted in LOLBAS: cmdl32 | LOLBAS Microsoft Connection Manager Auto-Download Paths: C:\Windows\System32\cmdl32.exe C:\Windows\SysWOW64\cmdl32.exe…lolbas-project.github.io

A couple of weeks ago I was tuning a log configuration in my lab and i encountered an event being generated quite often. (See below) Seeing the “cscript” utility being used is always a point of interest for me especially in this case, since the process launching it was the…

In today’s edition, we’ll cover a technique and a new feature in Microsoft Defender for Endpoint: PE header information. LOLBins, why you still should care There has been an abundance of blogs detailing all kinds of uses for these tools. Not only APTs and red teams are utilizing them, also a lot of malware authors are…

Overview Over the last few days, I researched and tested an interesting method to execute various COM scripts/scriptlets (e.g. VBscript, Jscript, etc.) Some of the great research already performed and documented by @subTee, @Oddvarmoe, @ItsReallyNick, @KyleHanslovan, @ChrisBisnett, and @NickTyrer. I was curious to see if there were any potentially artifacts to…