LOLBAS01 / TRADECRAFT
4 examplesCommand reference
ADS2
EXAMPLE 01T1564.004
Searches for the string W3AllLov3LolBas, since it does not exist (/V) the specified .exe file is written to an Alternate Data Stream (ADS) of the specified target file.
COMMAND
findstr /V /L W3AllLov3LolBas {PATH_ABSOLUTE:.exe} > {PATH_ABSOLUTE}:file.exeEXAMPLE 02T1564.004
Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is written to an Alternate Data Stream (ADS) of the file.txt file.
COMMAND
findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE}:file.exeCredentials1
EXAMPLE 01T1552.001
Search for stored password in Group Policy files stored on SYSVOL.
COMMAND
findstr /S /I cpassword \\sysvol\policies\*.xmlDownload1
EXAMPLE 01T1105
Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is downloaded to the target file.
COMMAND
findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE:.exe}02 / ON DISK
Known paths
C:\Windows\System32\findstr.exeC:\Windows\SysWOW64\findstr.exe03 / DEFENSIVE INTELLIGENCE
1 resourcesDetection & indicators
FURTHER READING
Research & resources
COMMUNITY RESEARCH
Acknowledgements
Oddvar Moe@oddvarmoe