LOLBAS. GitHub
LIVING OFF THE LAND / OS LIBRARIES

Ieframe.dll

View source

Internet Browser DLL for translating HTML code.

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218.011

Launch an executable payload via proxy through a(n) URL (information) file by calling OpenURL.

COMMAND
rundll32.exe ieframe.dll,OpenURL {PATH_ABSOLUTE:.url}
USE CASE
Load an executable payload by calling a .url file with or without quotes. The .url file extension can be renamed.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · URL
02 / ON DISK

Known paths

c:\windows\system32\ieframe.dll
c:\windows\syswow64\ieframe.dll
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources
REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Jimmy@bohops
Adam@hexacorn