Inject DLL into process with Mavinject
Tactic: Defense-evasion
This ability downloads a custom dll that can be injected into remote processes. The DLL will make a system() call for
whatever value is stored in the Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Prelude\Operator key with the name `bin_path`
(so bin_path with a string `C:\\Windows\\System32\\cmd.exe` for example). The DLL itself is designed to be injected
into a remote process where it will execute the binary listed in the registry key.
View Command
To view this TTPs command, you must be logged in with a professional or enterprise license.
LoginTest this TTP
Download Operator (1.7.1)
Follow @preludeorg on Twitter for new chains and more.
Join the Prelude Discord to discuss chains and more.
Keep up to date with code changes and community activity on Github