@cyclonedx/cdxgen
Version:
Creates CycloneDX Software Bill of Materials (SBOM) from source or container image
151 lines (150 loc) • 6.44 kB
JSON
{
"entries": {
"bitsadmin.exe": {
"attackTactics": ["TA0002", "TA0011"],
"attackTechniques": ["T1105", "T1197"],
"contexts": ["admin", "user"],
"functions": ["download", "upload", "command"],
"reference": "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/",
"riskTags": ["network-transfer", "persistence"]
},
"certutil.exe": {
"attackTactics": ["TA0005", "TA0011"],
"attackTechniques": ["T1105", "T1140"],
"contexts": ["admin", "user"],
"functions": ["download", "decode", "file-read", "file-write"],
"reference": "https://lolbas-project.github.io/lolbas/Binaries/Certutil/",
"riskTags": ["defense-evasion", "network-transfer"]
},
"cmd.exe": {
"attackTactics": ["TA0002"],
"attackTechniques": ["T1059.003"],
"contexts": ["admin", "user"],
"functions": ["command", "shell"],
"reference": "https://lolbas-project.github.io/lolbas/Binaries/Cmd/",
"riskTags": ["execution"]
},
"cmdkey.exe": {
"attackTactics": ["TA0006"],
"attackTechniques": ["T1555"],
"contexts": ["admin", "user"],
"functions": ["credential-access"],
"reference": "https://lolbas-project.github.io/lolbas/Binaries/Cmdkey/",
"riskTags": ["credential-access"]
},
"cmstp.exe": {
"attackTactics": ["TA0003", "TA0005"],
"attackTechniques": ["T1218.003", "T1548.002"],
"contexts": ["admin", "uac-bypass", "user"],
"functions": ["proxy-execution", "uac-bypass"],
"reference": "https://lolbas-project.github.io/lolbas/Binaries/Cmstp/",
"riskTags": ["defense-evasion", "persistence", "uac-bypass"]
},
"cscript.exe": {
"attackTactics": ["TA0002", "TA0005"],
"attackTechniques": ["T1059.005", "T1216"],
"contexts": ["admin", "user"],
"functions": ["proxy-execution", "script-execution"],
"reference": "https://lolbas-project.github.io/lolbas/Binaries/Cscript/",
"riskTags": ["defense-evasion", "execution"]
},
"ftp.exe": {
"attackTactics": ["TA0011"],
"attackTechniques": ["T1041", "T1105"],
"contexts": ["admin", "user"],
"functions": ["download", "upload"],
"reference": "https://lolbas-project.github.io/lolbas/Binaries/Ftp/",
"riskTags": ["network-transfer"]
},
"installutil.exe": {
"attackTactics": ["TA0002", "TA0005"],
"attackTechniques": ["T1218.004"],
"contexts": ["admin", "user"],
"functions": ["library-load", "proxy-execution"],
"reference": "https://lolbas-project.github.io/lolbas/Binaries/Installutil/",
"riskTags": ["defense-evasion", "execution"]
},
"msbuild.exe": {
"attackTactics": ["TA0002", "TA0005"],
"attackTechniques": ["T1127.001"],
"contexts": ["admin", "user"],
"functions": ["compile", "proxy-execution", "script-execution"],
"reference": "https://lolbas-project.github.io/lolbas/Binaries/Msbuild/",
"riskTags": ["defense-evasion", "execution"]
},
"mshta.exe": {
"attackTactics": ["TA0002", "TA0005"],
"attackTechniques": ["T1218.005"],
"contexts": ["admin", "user"],
"functions": ["proxy-execution", "script-execution"],
"reference": "https://lolbas-project.github.io/lolbas/Binaries/Mshta/",
"riskTags": ["defense-evasion", "execution"]
},
"msiexec.exe": {
"attackTactics": ["TA0002", "TA0005", "TA0011"],
"attackTechniques": ["T1105", "T1218.007"],
"contexts": ["admin", "user"],
"functions": ["download", "proxy-execution"],
"reference": "https://lolbas-project.github.io/lolbas/Binaries/Msiexec/",
"riskTags": ["defense-evasion", "network-transfer"]
},
"odbcconf.exe": {
"attackTactics": ["TA0002", "TA0005"],
"attackTechniques": ["T1218.008"],
"contexts": ["admin", "user"],
"functions": ["library-load", "proxy-execution"],
"reference": "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/",
"riskTags": ["defense-evasion", "execution"]
},
"powershell.exe": {
"attackTactics": ["TA0002", "TA0005", "TA0011"],
"attackTechniques": ["T1041", "T1059.001", "T1105"],
"contexts": ["admin", "user"],
"functions": ["command", "download", "script-execution", "shell", "upload"],
"reference": "https://lolbas-project.github.io/lolbas/Binaries/Powershell/",
"riskTags": ["execution", "network-transfer", "persistence"]
},
"pwsh.exe": {
"attackTactics": ["TA0002", "TA0005", "TA0011"],
"attackTechniques": ["T1041", "T1059.001", "T1105"],
"contexts": ["admin", "user"],
"functions": ["command", "download", "script-execution", "shell", "upload"],
"reference": "https://lolbas-project.github.io/lolbas/Binaries/Powershell/",
"riskTags": ["execution", "network-transfer", "persistence"]
},
"regsvr32.exe": {
"attackTactics": ["TA0002", "TA0005"],
"attackTechniques": ["T1218.010"],
"contexts": ["admin", "user"],
"functions": ["library-load", "proxy-execution", "script-execution"],
"reference": "https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/",
"riskTags": ["defense-evasion", "execution"]
},
"rundll32.exe": {
"attackTactics": ["TA0002", "TA0005"],
"attackTechniques": ["T1218.011"],
"contexts": ["admin", "user"],
"functions": ["library-load", "proxy-execution"],
"reference": "https://lolbas-project.github.io/lolbas/Binaries/Rundll32/",
"riskTags": ["defense-evasion", "execution"]
},
"wmic.exe": {
"attackTactics": ["TA0002", "TA0005", "TA0011"],
"attackTechniques": ["T1047", "T1105"],
"contexts": ["admin", "user"],
"functions": ["command", "download", "process-create"],
"reference": "https://lolbas-project.github.io/lolbas/Binaries/Wmic/",
"riskTags": ["execution", "network-transfer", "reconnaissance"]
},
"wscript.exe": {
"attackTactics": ["TA0002", "TA0005"],
"attackTechniques": ["T1059.005", "T1216"],
"contexts": ["admin", "user"],
"functions": ["proxy-execution", "script-execution"],
"reference": "https://lolbas-project.github.io/lolbas/Binaries/Wscript/",
"riskTags": ["defense-evasion", "execution"]
}
},
"source": "https://github.com/LOLBAS-Project/LOLBAS",
"sourceRef": "https://lolbas-project.github.io/"
}