Skip to content

LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Mscopilot.exe

Microsoft Copilot app

01COMMAND EXAMPLES

01ATT&CK TECHNIQUES

00DETECTION RESOURCES

01CAPABILITIES

01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218.015

`mscopilot.exe` will spawn the provided command. Parent `mscopilot.exe` process needs to be killed to avoid command being executed an infinite number of times.

COMMAND

mscopilot.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher="{CMD} && taskkill /f /im mscopilot.exe &&"

USE CASE: Executes a process under a trusted Microsoft signed binary
PRIVILEGES: User
OPERATING SYSTEM: Windows 11

Execute · CMD

02 / ON DISK

Known paths

C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot.exe

03 / DEFENSIVE INTELLIGENCE

Detection & indicators

0 resources

No detection resources documented yet.

Contribute detection coverage

FURTHER READING

Research & resources

READtour de mscopilotgithub.com

COMMUNITY RESEARCH

Acknowledgements

4n4s4zi@4n4s4zi