Create Mofcomp.yml - #513
Open
josehelps wants to merge 3 commits into
Open
Conversation
- Capitalize Name field to match repo convention - Add missing Code_Sample field - Fix OperatingSystem casing and format - Differentiate the two command Usecases
wietze
reviewed
Jul 28, 2026
wietze
left a comment
wietze
left a comment
Member
There was a problem hiding this comment.
A couple of suggestions from me
| Author: Daniel Gott | ||
| Created: 2022-07-19 | ||
| Commands: | ||
| - Command: mofcomp.exe C:\Windows\SERVIC~1\MSSQL$~1\AppData\Local\Temp\xitmf |
Member
There was a problem hiding this comment.
Why this path? Since it is not explained, I'm guessing this should be generalised to {PATH_ABSOLUTE:.mof}
Comment on lines
+24
to
+25
| Code_Sample: | ||
| - Code: N/A |
Comment on lines
+14
to
+20
| - Command: mofcomp.exe C:\Programdata\x.mof | ||
| Description: Abuse of mofcomp.exe to parse a file which contains MOF statements in order create new classes as part of the WMI repository | ||
| Usecase: Threat actors can use mofcomp.exe to register a malicious MOF file as a new class in the WMI repository | ||
| Category: Execute | ||
| Privileges: User | ||
| MitreID: T1047 | ||
| OperatingSystem: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11, Windows Server 2008+ |
Member
There was a problem hiding this comment.
This is redundant if we generalise the first example, and can be removed.
| Description: Abuse of mofcomp.exe to parse a file which contains MOF statements in order create new classes as part of the WMI repository | ||
| Usecase: Threat actors can use mofcomp.exe to decompile a BMOF binary and then register a malicious class in the WMI repository | ||
| Category: Execute | ||
| Privileges: User |
Member
There was a problem hiding this comment.
We should include
Tags:
- Execute: MOF| - Code: N/A | ||
| Detection: | ||
| - IOC: strange parent processes spawning mofcomp.exe like cmd.exe or powershell.exe | ||
| - Sigma: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_mofcomp_execution.yml |
Member
There was a problem hiding this comment.
No longer exists - should be using commit hashes like the example below anyway
Open
- Generalise command path to {PATH_ABSOLUTE:.mof}
- Remove redundant second command example
- Add Execute: MOF tag
- Remove empty Code_Sample section
- Remove dead SigmaHQ sigma link
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Create lolbas yml entry for the Windows binary
mofcomp.exe. Supersedes #236 (closed in favor of this PR with review feedback applied).Changes applied during review:
Namefield to match repo conventionCode_SamplefieldOperatingSystemcasing and formatUsecasesRelates to issue #137. Credit to @danielgottt for the original entry.