huntrule

Suspicious More_eggs ie4uinit Copy to AppData Microsoft Folder

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-21
Updated
2026-09-21
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the signed ie4uinit binary being executed from a user AppData Microsoft folder rather than System32. More_eggs fake job applicant lures copy ie4uinit alongside an attacker written ieuinit inf to abuse its inf handling. Running the LOLBIN from the wrong path enables execution of attacker controlled directives under a trusted name.

Reporting behind it

Related detections9 linkedT1218 — drag to rearrange
Suspicious Microsoft.NodejsTools.PressAnyKey LOLBAS Proxy Execution
Suspicious Renamed Windows Debugger CDB Execution
Suspicious Scripting Interpreter Execution From Downloads Or Temp via Reputation Hijacking
Suspicious MMC Console Spawning Script Interpreter via GrimResource
Suspicious MMC Console Loading MSC File From User Writable Path
Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32
Malicious DLL Execution via Wuauclt Update Handler (via process_creation)
Malicious aspnet_compiler.exe Injection Host Spawned by PowerShell via process_creation
Malicious regsvcs LOLBin Loading Ransomware DLL from UNC Path
Suspicious More_eggs ie4uinit Copy to AppData Microsoft Folder
Pivot detection · T1218 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.