LOL · OtherMSBinary

Msdeploy.exe

3 techniques WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Launch .bat file via msdeploy.exe.

Use Local execution of batch file using msdeploy.exe.

msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="{PATH_ABSOLUTE:.bat}"

Context: user
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_msdeploy.yml
Refs: twitter.com/pabraeken/status/995837734379032576
twitter.com/pabraeken/status/999090532839313408
lolbas-project.github.io/lolbas/OtherMSBinaries/Msdeploy/

AWL Bypass

AWL / Policy Bypass Windows

Launch .bat file via msdeploy.exe.

Use Local execution of batch file using msdeploy.exe.

msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="{PATH_ABSOLUTE:.bat}"

Context: user
Native: AWL Bypass
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_msdeploy.yml
Refs: twitter.com/pabraeken/status/995837734379032576
twitter.com/pabraeken/status/999090532839313408
lolbas-project.github.io/lolbas/OtherMSBinaries/Msdeploy/

Copy

File Copy Windows

Copy file from source to destination.

Use Copy file.

msdeploy.exe -verb:sync -source:filePath={PATH_ABSOLUTE:.source.ext} -dest:filePath={PATH_ABSOLUTE:.dest.ext}

Context: user
Native: Copy
MITRE: T1105
Detection: Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_msdeploy.yml
Refs: twitter.com/pabraeken/status/995837734379032576
twitter.com/pabraeken/status/999090532839313408
lolbas-project.github.io/lolbas/OtherMSBinaries/Msdeploy/