Skip to content

Commit

Permalink
Added lolbas iediagcmd.exe as discovered by Adam @hexacorn (#199)
Browse files Browse the repository at this point in the history
Everything looks good, confirmed working on Windows 10 & 11, merging changes:

* Added 'Execute' lolbas for iediagcmd.exe

* Added missing fields from the template

* Update Iediagcmd.yml

Made corrections

* Update Iediagcmd.yml

Removing trailing spaces

* Update Iediagcmd.yml

removing empty fields

* Minor changes

* Update Iediagcmd.yml

Removing space before first "&". When setting the Environment variable, it's picking up the space so the path seemed to be "c:\test \", which is why tests are failing.

* Adding Windows 11 support

---------

Co-authored-by: Conor Richard <[email protected]>
Co-authored-by: Wietze <[email protected]>
  • Loading branch information
3 people authored Oct 4, 2023
1 parent 90f666e commit d6e4fb0
Showing 1 changed file with 24 additions and 0 deletions.
24 changes: 24 additions & 0 deletions yml/OSBinaries/Iediagcmd.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
---
Name: iediagcmd.exe
Description: Diagnostics Utility for Internet Explorer
Author: manasmbellani
Created: 2022-03-29
Commands:
- Command: 'set windir=c:\test& cd "C:\Program Files\Internet Explorer\" & iediagcmd.exe /out:c:\test\foo.cab'
Description: Executes binary that is pre-planted at C:\test\system32\netsh.exe.
Usecase: Spawn a pre-planted executable from iediagcmd.exe.
Category: Execute
Privileges: User
MitreID: T1218
OperatingSystem: Windows 10 1803, Windows 10 1703, Windows 10 22H1, Windows 10 22H2, Windows 11
Full_Path:
- Path: C:\Program Files\Internet Explorer\iediagcmd.exe
Detection:
- Sigma: https://github.com/manasmbellani/mycode_public/blob/master/sigma/rules/win_proc_creation_lolbin_iediagcmd.yml
- IOC: Sysmon Event ID 1
- IOC: Execution of process iediagcmd.exe with /out could be suspicious
Resources:
- Link: https://twitter.com/Hexacorn/status/1507516393859731456
Acknowledgement:
- Person: Adam
Handle: '@hexacorn'

0 comments on commit d6e4fb0

Please sign in to comment.