LOLBAS/yml/OSBinaries/Iediagcmd.yml

---
Name: iediagcmd.exe
Description: Diagnostics Utility for Internet Explorer
Author: manasmbellani
Created: 2022-03-29
Commands:
  - Command: 'set windir=c:\test& cd "C:\Program Files\Internet Explorer\" & iediagcmd.exe /out:c:\test\foo.cab'
    Description: Executes binary that is pre-planted at C:\test\system32\netsh.exe.
    Usecase: Spawn a pre-planted executable from iediagcmd.exe.
    Category: Execute
    Privileges: User
    MitreID: T1218
    OperatingSystem: Windows 10 1803, Windows 10 1703, Windows 10 22H1, Windows 10 22H2, Windows 11
Full_Path:
  - Path: C:\Program Files\Internet Explorer\iediagcmd.exe
Detection:
  - Sigma: https://github.com/manasmbellani/mycode_public/blob/master/sigma/rules/win_proc_creation_lolbin_iediagcmd.yml
  - IOC: Sysmon Event ID 1
  - IOC: Execution of process iediagcmd.exe with /out could be suspicious
Resources:
  - Link: https://twitter.com/Hexacorn/status/1507516393859731456
Acknowledgement:
  - Person: Adam
    Handle: '@hexacorn'
Added lolbas iediagcmd.exe as discovered by Adam @hexacorn (#199) Everything looks good, confirmed working on Windows 10 & 11, merging changes: * Added 'Execute' lolbas for iediagcmd.exe * Added missing fields from the template * Update Iediagcmd.yml Made corrections * Update Iediagcmd.yml Removing trailing spaces * Update Iediagcmd.yml removing empty fields * Minor changes * Update Iediagcmd.yml Removing space before first "&". When setting the Environment variable, it's picking up the space so the path seemed to be "c:\test \", which is why tests are failing. * Adding Windows 11 support --------- Co-authored-by: Conor Richard <xenos@xenos-1.net> Co-authored-by: Wietze <wietze@users.noreply.github.com> 2023-10-04 15:47:18 +02:00			`---`
			`Name: iediagcmd.exe`
			`Description: Diagnostics Utility for Internet Explorer`
			`Author: manasmbellani`
			`Created: 2022-03-29`
			`Commands:`
			`- Command: 'set windir=c:\test& cd "C:\Program Files\Internet Explorer\" & iediagcmd.exe /out:c:\test\foo.cab'`
			`Description: Executes binary that is pre-planted at C:\test\system32\netsh.exe.`
			`Usecase: Spawn a pre-planted executable from iediagcmd.exe.`
			`Category: Execute`
			`Privileges: User`
			`MitreID: T1218`
			`OperatingSystem: Windows 10 1803, Windows 10 1703, Windows 10 22H1, Windows 10 22H2, Windows 11`
			`Full_Path:`
			`- Path: C:\Program Files\Internet Explorer\iediagcmd.exe`
			`Detection:`
			`- Sigma: https://github.com/manasmbellani/mycode_public/blob/master/sigma/rules/win_proc_creation_lolbin_iediagcmd.yml`
			`- IOC: Sysmon Event ID 1`
			`- IOC: Execution of process iediagcmd.exe with /out could be suspicious`
			`Resources:`
			`- Link: https://twitter.com/Hexacorn/status/1507516393859731456`
			`Acknowledgement:`
			`- Person: Adam`
			`Handle: '@hexacorn'`