We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
2 parents efb972e + e3d378b commit 09a8aacCopy full SHA for 09a8aac
test-sets/cobaltstrike/cobaltstrike-simulation.bat
@@ -43,7 +43,7 @@ ECHO Copy a service binary file to a suspicious location ...
43
ECHO Using Post-CobaltStrike 4.2 scheme
44
copy "%APTDIR%\CreateNamedPipe.exe" \\%COMPUTERNAME%\ADMIN$\b6a1458f396.exe
45
ECHO Starting suspicious service
46
-sc create tbbd05 binpath= "%%COMSPEC%% echo /c b6a1458f396 > \\.\pipe\334485" DisplayName= "tbbd05" start= demand
+sc create tbbd05 binpath= "%%COMSPEC%% /c echo b6a1458f396 > \\.\pipe\334485" DisplayName= "tbbd05" start= demand
47
sc start tbbd05
48
sc stop tbbd05
49
sc delete tbbd05
0 commit comments