File Download And Execution Via IEExec.EXE

calendar Nov 14, 2023 · attack.command_and_control attack.t1105  ·
Share on: linkedin copy

Detects execution of the IEExec utility to download and execute files

Sigma rule (View on GitHub)

 1title: File Download And Execution Via IEExec.EXE
 2id: 9801abb8-e297-4dbf-9fbd-57dde0e830ad
 3status: test
 4description: Detects execution of the IEExec utility to download and execute files
 5references:
 6    - https://lolbas-project.github.io/lolbas/Binaries/Ieexec/
 7author: Nasreddine Bencherchali (Nextron Systems)
 8date: 2022/05/16
 9modified: 2023/11/09
10tags:
11    - attack.command_and_control
12    - attack.t1105
13logsource:
14    category: process_creation
15    product: windows
16detection:
17    selection_img:
18        - Image|endswith: '\IEExec.exe'
19        - OriginalFileName: 'IEExec.exe'
20    selection_cli:
21        CommandLine|contains:
22            - 'http://'
23            - 'https://'
24    condition: all of selection_*
25falsepositives:
26    - Unknown
27level: high

References

  • Ieexec | LOLBAS

    .. /Ieexec.exe Star Download Execute The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe applicat...


    Read More

Related rules

to-top