iediagcmd.exe

Commands

1. ExecuteUser T1218

   Spawn a pre-planted executable from iediagcmd.exe.

   set windir=c:\test& cd "C:\Program Files\Internet Explorer\" & iediagcmd.exe /out:{PATH_ABSOLUTE:.cab}

   Executes binary that is pre-planted at C:\test\system32\netsh.exe.

   os: Windows 10 1803, Windows 10 1703, Windows 10 22H1, Windows 10 22H2, Windows 11

   Execute: EXE

Detection

• Sigma https://github.com/manasmbellani/mycode_public/blob/master/sigma/rules/win_proc_creation_lolbin_iediagcmd.yml
• IOCSysmon Event ID 1
• IOCExecution of process iediagcmd.exe with /out could be suspicious

Resources

• https://twitter.com/Hexacorn/status/1507516393859731456