Windows: ie4uinit.exe executed from unusual CurrentDirectory (invalid path)

Flags ie4uinit.exe runs whose CurrentDirectory is outside expected system paths, indicating potential LOLBIN misuse.

FreeUnreviewedSigmamediumv1

windows-ie4uinit-exe-executed-from-unusual-currentdirectory-invalid-path-d3bf399f

title: "Windows: ie4uinit.exe executed from unusual CurrentDirectory (invalid path)"
id: 8b72843b-1ec3-4484-8255-8c7b6de76eae
status: test
description: This rule identifies process creation where ie4uinit.exe is launched, but the CurrentDirectory is not one of the expected system locations. Attackers can misuse ie4uinit.exe along with specially prepared configuration content to execute actions while blending in with legitimate Windows tooling. The detection relies on Windows process creation telemetry, matching the ie4uinit executable and filtering based on the process CurrentDirectory.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/
  - https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_ie4uinit.yml
author: frack113, Huntrule Team
date: 2022-05-07
modified: 2022-05-16
tags:
  - attack.stealth
  - attack.t1218
logsource:
  product: windows
  category: process_creation
detection:
  lolbin:
    - Image|endswith: \ie4uinit.exe
    - OriginalFileName: IE4UINIT.EXE
  filter_correct:
    CurrentDirectory:
      - c:\windows\system32\
      - c:\windows\sysWOW64\
  filter_missing:
    CurrentDirectory: null
  condition: lolbin and not 1 of filter_*
falsepositives:
  - ViberPC updater calls this binary with the following commandline "ie4uinit.exe -ClearIconCache"
level: medium
license: DRL-1.1
related:
  - id: d3bf399f-b0cf-4250-8bb4-dfc192ab81dc
    type: derived

What it detects

This rule identifies process creation where ie4uinit.exe is launched, but the CurrentDirectory is not one of the expected system locations. Attackers can misuse ie4uinit.exe along with specially prepared configuration content to execute actions while blending in with legitimate Windows tooling. The detection relies on Windows process creation telemetry, matching the ie4uinit executable and filtering based on the process CurrentDirectory.

Known false positives

ViberPC updater calls this binary with the following commandline "ie4uinit.exe -ClearIconCache"

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.