Windows IEExec.exe Download-and-Execute Execution via Process Creation

title: Windows IEExec.exe Download-and-Execute Execution via Process Creation
id: 57134c47-7eb6-4847-9e70-ea1d7250f14c
status: test
description: This rule identifies process executions of IEExec.exe, specifically when the command line includes http:// or https://. Attackers can use IEExec to retrieve a remote payload and trigger execution in a single utility-driven workflow. The detection relies on Windows process creation telemetry, matching the executable image/metadata and inspecting the command line for web-based download indicators.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Ieexec/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ieexec_download.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-05-16
modified: 2023-11-09
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \IEExec.exe
    - OriginalFileName: IEExec.exe
  selection_cli:
    CommandLine|contains:
      - http://
      - https://
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9801abb8-e297-4dbf-9fbd-57dde0e830ad
    type: derived