From b9021def4201dd125a84adf372e67806a105cb3c Mon Sep 17 00:00:00 2001 From: brightmt <50853930+brightmt@users.noreply.github.com> Date: Wed, 2 Oct 2024 11:01:10 -0400 Subject: [PATCH] Update exploitation-for-client-execution.md Updated link to Windows utilities --- execution/exploitation-for-client-execution.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/execution/exploitation-for-client-execution.md b/execution/exploitation-for-client-execution.md index e355e29..623cd5f 100644 --- a/execution/exploitation-for-client-execution.md +++ b/execution/exploitation-for-client-execution.md @@ -67,8 +67,8 @@ See ATT&CK: **Exploitation for Client Execution ([T1203](https://attack.mitre.or |[stack_pivot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|VirtualProtectEx, NtAllocateVirtualMemory, NtMapViewOfSection, NtWriteVirtualMemory, NtWow64WriteVirtualMemory64, URLDownloadToFileW, WriteProcessMemory, NtProtectVirtualMemory| |[stack_pivot_file_created](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|NtCreateFile| |[stack_pivot_process_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|NtCreateUserProcess, CreateProcessInternalW| -|[uses_windows_utilities](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/uses_windows.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--| -|[uses_windows_utilities_curl](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/uses_windows.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--| +|[uses_windows_utilities](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/windows_utilities.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--| +|[uses_windows_utilities_curl](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/windows_utilities.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--| |[cve_2014_6332](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2014_6332.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile| |[exploit_gethaldispatchtable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/exploit_gethaldispatchtable.py)|Exploitation for Client Execution (E1203)|LdrGetProcedureAddress, LdrLoadDll| |[cve_2015_2419_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2015_2419.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|