Suspicious Ie4uinit Lolbin Use From Invalid Path (via process_creation)

title: Suspicious Ie4uinit Lolbin Use From Invalid Path (via process_creation)
id: 63bb3bf2-9ecb-5962-90db-8ab8d3c42036
status: stable
description: This rule detects use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories
references:
    - https://attack.mitre.org/techniques/T1218/
    - https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/
    - https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/
author: Huntrule Team
date: 2026-01-06
tags:
    - attack.stealth
    - attack.t1218
logsource:
    product: windows
    category: process_creation
detection:
    lolbin:
        - Image|endswith: '\ie4uinit.exe'
        - OriginalFileName: 'IE4UINIT.EXE'
    filter_correct:
        CurrentDirectory:
            - 'c:\windows\system32\'
            - 'c:\windows\sysWOW64\'
    filter_missing:
        CurrentDirectory:
    condition: lolbin and not 1 of filter_*
falsepositives:
    - Unknown
level: medium