LOLBAS Expand

LOLBAS. (n.d.). Expand.exe. Retrieved February 19, 2019.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1564.004 NTFS File Attributes	ToolExpand	Expand can be used to download or copy a file into an alternate data stream. LOLBAS Expand
T1570 Lateral Tool Transfer	ToolExpand	Expand can be used to download or upload a file over a network share. LOLBAS Expand

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.