LOL · OtherMSBinary

OpenConsole.exe

1 technique WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Execute specified process with OpenConsole.exe as parent process

Use Use OpenConsole.exe as a proxy binary to evade defensive counter-measures

OpenConsole.exe {PATH:.exe}

Context: user
Native: Execute
MITRE: T1202
Detection: IOC: OpenConsole.exe spawning unexpected processes
Sigma: github.com/SigmaHQ/sigma/blob/9e0ef7251b075f15e7abafbbec16d3230c5fa477/rules/windows/process_creation/proc_creation_win_lolbin_openconsole.yml
Refs: twitter.com/nas_bench/status/1537563834478645252
lolbas-project.github.io/lolbas/OtherMSBinaries/OpenConsole/