iediagcmd.exe — LOLBAS

Execute

ExecutionWindows

Executes binary that is pre-planted at C:\test\system32\netsh.exe.

Use Spawn a pre-planted executable from iediagcmd.exe.

set windir=c:\test& cd "C:\Program Files\Internet Explorer\" & iediagcmd.exe /out:{PATH_ABSOLUTE:.cab}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/manasmbellani/mycode_public/blob/master/sigma/rules/win_proc_creation_lolbin_iediagcmd.yml
IOC: Sysmon Event ID 1
IOC: Execution of process iediagcmd.exe with /out could be suspicious
Refs: twitter.com/Hexacorn/status/1507516393859731456
lolbas-project.github.io/lolbas/Binaries/iediagcmd/