Mscopilot.exe

`mscopilot.exe` will spawn the provided command. Parent `mscopilot.exe` process needs to be killed to avoid command being executed an infinite number of times.

Use Executes a process under a trusted Microsoft signed binary

mscopilot.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher="{CMD} && taskkill /f /im mscopilot.exe &&"

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218.015

Refs

github.com/4n4s4zi/tour-de-mscopilot

lolbas-project.github.io/lolbas/OtherMSBinaries/Mscopilot/