WorkFolders.exe

Commands

1. ExecuteUser T1218

   Can be used to evade defensive countermeasures or to hide as a persistence mechanism

   WorkFolders

   Execute control.exe in the current working directory

   os: Windows 8, Windows 8.1, Windows 10, Windows 11

   Execute: EXERequires: Rename

2. ExecuteUser T1218

   Proxy execution of a malicious payload via App Paths registry hijacking.

   WorkFolders

   WorkFolders attempts to execute control.exe. By modifying the default value of the App Paths registry key for control.exe in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\control.exe, an attacker can achieve proxy execution.

   os: Windows 10, Windows 11

   Execute: EXERequires: Registry change

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_susp_workfolders.yml
• IOCWorkFolders.exe should not be run on a normal workstation
• IOCRegistry modification to HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\control.exe

Resources

• https://www.ctus.io/2021/04/12/exploading/
• https://twitter.com/ElliotKillick/status/1449812843772227588