LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

msedgewebview2.exe

View source

msedgewebview2.exe is the executable file for Microsoft Edge WebView2, which is a web browser control used by applications to display web content.

Execute
04COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

4 examples

Execute4

EXAMPLE 01T1218.015

This command launches the Microsoft Edge WebView2 browser control without sandboxing and will spawn the specified executable as its subprocess.

COMMAND
msedgewebview2.exe --no-sandbox --browser-subprocess-path="{PATH_ABSOLUTE:.exe}"
USE CASE
Proxy execution of binary
PRIVILEGES
Low privileges
OPERATING SYSTEM
Windows 10, Windows 11
Execute · EXE
EXAMPLE 02T1218.015

This command launches the Microsoft Edge WebView2 browser control without sandboxing and will spawn the specified command as its subprocess.

COMMAND
msedgewebview2.exe --utility-cmd-prefix="{CMD}"
USE CASE
Proxy execution of binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · CMD
EXAMPLE 03T1218.015

This command launches the Microsoft Edge WebView2 browser control without sandboxing and will spawn the specified command as its subprocess.

COMMAND
msedgewebview2.exe --disable-gpu-sandbox --gpu-launcher="{CMD}"
USE CASE
Proxy execution of binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · CMD
EXAMPLE 04T1218.015

This command launches the Microsoft Edge WebView2 browser control without sandboxing and will spawn the specified command as its subprocess.

COMMAND
msedgewebview2.exe --no-sandbox --renderer-cmd-prefix="{CMD}"
USE CASE
Proxy execution of binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · CMD
02 / ON DISK

Known paths

C:\Program Files (x86)\Microsoft\Edge\Application\114.0.1823.43\msedgewebview2.exe
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    msedgewebview2.exe spawned with any of the following: --gpu-launcher, --utility-cmd-prefix, --renderer-cmd-prefix, --browser-subprocess-path

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Uriel Kosayev@MalFuzzer
Hai Vaknin@VakninHai
Tamir Yehuda@Tamirye94
Matan Bahar@Bl4ckShad3