Mscopilot.exe

Commands

1. ExecuteUser T1218.015

   Executes a process under a trusted Microsoft signed binary

   mscopilot.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher="{CMD} && taskkill /f /im mscopilot.exe &&"

   mscopilot.exe will spawn the provided command. Parent mscopilot.exe process needs to be killed to avoid command being executed an infinite number of times.

   os: Windows 11

   Execute: CMD

Resources

• https://github.com/4n4s4zi/tour-de-mscopilot