Uploading WinAutomation Screenshots to Azure Container Storage Using Invoke-AzVMRunCommand
Tags
attack-pattern: Ip Addresses - T1590.005 Powershell - T1059.001 Software - T1592.002 Powershell - T1086
Show in Graph
Common Information
Type Value
UUID 47bd7cdc-e7ca-4f38-a24f-1705789a31f8
Fingerprint bc0aaa25235147b2
Analysis status DONE
Considered CTI value 0
Text language
Published Nov. 4, 2020, noon
Added to db Aug. 31, 2024, 12:09 a.m.
Last updated Nov. 12, 2024, 6:02 a.m.
Headline UNKNOWN
Title Uploading WinAutomation Screenshots to Azure Container Storage Using Invoke-AzVMRunCommand
Detected Hints/Tags/Attributes 27/1/12
Source URLs
Redirection Url
Details Source https://www.optiv.com/insights/source-zero/blog/uploading-winautomation-screenshots-azure-container-storage-using-invoke
URL Provider
Details Provider Source level domain
Details optiv.com www.optiv.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 346 ✔ Optiv Blog https://www.optiv.com/resources/blog/feed 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 281 
docs.microsoft.com
Details Domain 72 
optiv.com
Details Email 65 
legal@optiv.com
Details File 1 
proccess.dat
Details File 2 
rpademoshare.blob
Details File 21 
script.ps1
Details Url 1 
https://rpademoshare.blob.core.windows.net/winautomation-logs/?sv=2019
Details Url 2 
https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10
Details Url 1 
https://docs.microsoft.com/en-us/azure/storage/common/storage-ref-azcopy-copy
Details Url 1 
https://docs.microsoft.com/en-us/cli/azure/vm/run-command?view=azure
Details Url 1 
https://docs.microsoft.com/en-us/powershell/module/az.compute/invoke-azvmruncommand?view=azps-4.6.1
Details Url 2 
https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-windows