Lolbin Runexehelper Use As Proxy
Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs
Sigma rule (View on GitHub)
1title: Lolbin Runexehelper Use As Proxy
2id: cd71385d-fd9b-4691-9b98-2b1f7e508714
3status: test
4description: Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs
5references:
6 - https://twitter.com/0gtweet/status/1206692239839289344
7 - https://lolbas-project.github.io/lolbas/Binaries/Runexehelper/
8author: frack113
9date: 2022-12-29
10tags:
11 - attack.defense-evasion
12 - attack.t1218
13logsource:
14 category: process_creation
15 product: windows
16detection:
17 selection:
18 ParentImage|endswith: '\runexehelper.exe'
19 condition: selection
20falsepositives:
21 - Unknown
22level: medium
References
-
Runexehelper.exe is a living-of-the-land file containing unexpected functionality that can be abused by attackers; this page lists all its use cases.
Read More
Related rules
- Abusing Print Executable
- AddinUtil.EXE Execution From Uncommon Directory
- AgentExecutor PowerShell Execution
- Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE
- Arbitrary File Download Via MSOHTMED.EXE