LOL · Binary

Replace.exe

2 techniquesWindowsLOLBASGPL-3.0

Copy

File CopyWindows

Copy .cab file to destination

Use Copy files

replace.exe {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE:folder} /A

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Copy
MITRE: T1105
Detection: IOC: Replace.exe retrieving files from remote server
Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_replace.yml
Refs: twitter.com/elceef/status/986334113941655553
twitter.com/elceef/status/986842299861782529
lolbas-project.github.io/lolbas/Binaries/Replace/

File DownloadWindows

Download/Copy executable to specified folder

Use Download file

replace.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:folder} /A

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Download
MITRE: T1105
Detection: IOC: Replace.exe retrieving files from remote server
Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_replace.yml
Refs: twitter.com/elceef/status/986334113941655553
twitter.com/elceef/status/986842299861782529
lolbas-project.github.io/lolbas/Binaries/Replace/