Mscopilot_proxy.exe

`mscopilot_proxy.exe` will spawn the provided command. Parent `mscopilot_proxy.exe` process needs to be killed to avoid command being executed an infinite number of times.

Use Executes a process under a trusted Microsoft signed binary

mscopilot_proxy.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher="cmd.exe /c calc.exe && taskkill /f /im mscopilot.exe &&"

Context

user

Native

Execute

MITRE

T1218.015

Refs

github.com/4n4s4zi/tour-de-mscopilot

lolbas-project.github.io/lolbas/OtherMSBinaries/Mscopilot_proxy/