LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Stordiag.exe

View source

Storage diagnostic tool

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1218

Once executed, Stordiag.exe will execute schtasks.exe systeminfo.exe and fltmc.exe - if stordiag.exe is copied to a folder and an arbitrary executable is renamed to one of these names, stordiag.exe will execute it.

COMMAND
stordiag.exe
USE CASE
Possible defence evasion purposes.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10
Execute · EXE
EXAMPLE 02T1218

Once executed, Stordiag.exe will execute schtasks.exe and powershell.exe - if stordiag.exe is copied to a folder and an arbitrary executable is renamed to one of these names, stordiag.exe will execute it.

COMMAND
stordiag.exe
USE CASE
Possible defence evasion purposes.
PRIVILEGES
User
OPERATING SYSTEM
Windows 11
Execute · EXE
02 / ON DISK

Known paths

c:\windows\system32\stordiag.exe
c:\windows\syswow64\stordiag.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    systeminfo.exe, fltmc.exe or schtasks.exe or powershell.exe being executed outside of their normal path of c:\windows\system32\ or c:\windows\syswow64\

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Eral4m@eral4m
Ekitji@eki_erk