Red Teaming Experiments
linkedingithub@spotheplanetpatreon
Search…
What is ired.team?
Pinned
Pentesting Cheatsheets
Active Directory & Kerberos Abuse
offensive security
Red Team Infrastructure
Initial Access
Code Execution
regsvr32
MSHTA
Control Panel Item
Executing Code as a Control Panel Item through an Exported Cplapplet Function
Code Execution through Control Panel Add-ins
CMSTP
InstallUtil
Using MSBuild to Execute Shellcode in C#
Forfiles Indirect Command Execution
Application Whitelisting Bypass with WMIC and XSL
Powershell Without Powershell.exe
Powershell Constrained Language Mode ByPass
Forcing Iexplore.exe to Load a Malicious DLL via COM Abuse
pubprn.vbs Signed Script Code Execution
Code & Process Injection
Defense Evasion
Enumeration and Discovery
Privilege Escalation
Credential Access & Dumping
Lateral Movement
Persistence
Exfiltration
reversing, forensics & misc
Internals
Cloud
Neo4j
Dump Virtual Box Memory
AES Encryption Using Crypto++ .lib in Visual Studio C++
Reversing Password Checking Routine
Powered By GitBook
Forfiles Indirect Command Execution
Defense Evasion
This technique launches an executable without a cmd.exe.

Execution

1
forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe
Copied!

Observations

Defenders can monitor for process creation/commandline logs to detect this activity:

References

Indirect Command Execution, Technique T1202 - Enterprise | MITRE ATT&CK®
Previous
Using MSBuild to Execute Shellcode in C#
Next
Application Whitelisting Bypass with WMIC and XSL
Last modified 3yr ago
Copy link
Contents
Execution
Observations
References