LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Provlaunch.exe

View source

Launcher process

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
04DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Executes command defined in the Registry. Requires 3 levels of the key structure containing some keywords. Such keys may be created with two reg.exe commands, e.g. `reg.exe add HKLM\SOFTWARE\Microsoft\Provisioning\Commands\LOLBin\dummy1 /v altitude /t REG_DWORD /d 0` and `reg add HKLM\SOFTWARE\Microsoft\Provisioning\Commands\LOLBin\dummy1\dummy2 /v Commandline /d calc.exe`. Registry keys are deleted after successful execution.

COMMAND
provlaunch.exe LOLBin
USE CASE
Executes arbitrary command
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022
Execute · CMD
02 / ON DISK

Known paths

c:\windows\system32\provlaunch.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

4 resources

Indicators & detection notes

  • IOC

    c:\windows\system32\provlaunch.exe executions

  • IOC

    Creation/existence of HKLM\SOFTWARE\Microsoft\Provisioning\Commands subkeys

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Grzegorz Tworek@0gtweet