LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Mscopilot_proxy.exe

View source

Microsoft Copilot proxy launcher

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
00DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218.015

`mscopilot_proxy.exe` will spawn the provided command. Parent `mscopilot_proxy.exe` process needs to be killed to avoid command being executed an infinite number of times.

COMMAND
mscopilot_proxy.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher="cmd.exe /c calc.exe && taskkill /f /im mscopilot.exe &&"
USE CASE
Executes a process under a trusted Microsoft signed binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 11
Execute · CMD
02 / ON DISK

Known paths

C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot_proxy.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

0 resources

No detection resources documented yet.

Contribute detection coverage
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

4n4s4zi@4n4s4zi