IMEWDBLD.EXE Initiated Network Connections on Windows

Alerts when IMEWDBLD.EXE initiates a network connection on Windows.

FreeUnreviewedSigmahighv1

imewdbld-exe-initiated-network-connections-on-windows-8d7e392e

title: IMEWDBLD.EXE Initiated Network Connections on Windows
id: 272482a7-3a2f-488e-81b3-870e91409a2c
related:
  - id: 863218bd-c7d0-4c52-80cd-0a96c09f54af
    type: derived
  - id: 8d7e392e-9b28-49e1-831d-5949c6281228
    type: derived
status: test
description: This rule flags Windows network_connection events where the connection was initiated by IMEWDBLD.EXE. Attackers may abuse this binary to establish command-and-control or to stage follow-on activity. The detection relies on telemetry that records the initiating process identity and connection initiation status.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-10---windows---powershell-download
  - https://lolbas-project.github.io/lolbas/Binaries/IMEWDBLD/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_imewdbld.yml
author: frack113, Huntrule Team
date: 2022-01-22
modified: 2023-11-09
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    Image|endswith: \IMEWDBLD.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Windows network_connection events where the connection was initiated by IMEWDBLD.EXE. Attackers may abuse this binary to establish command-and-control or to stage follow-on activity. The detection relies on telemetry that records the initiating process identity and connection initiation status.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.