Windows Process Creation: MpCmdRun.EXE Used to Download Files via DownloadFile url

title: "Windows Process Creation: MpCmdRun.EXE Used to Download Files via DownloadFile url"
id: 161c37ab-7ce7-4c93-aff5-4764f5df71ed
status: test
description: This rule flags process creation events where Windows Defender’s MpCmdRun.exe is launched and its command line includes the DownloadFile action with a url parameter. Attackers may abuse built-in security utilities to blend in with legitimate activity while retrieving remote payloads. The detection relies on process creation telemetry, specifically the original executable name, the process image path, and command-line contents matching DownloadFile and url.
references:
  - https://web.archive.org/web/20200903194959/https://twitter.com/djmtshepana/status/1301608169496612866
  - https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mpcmdrun_download_arbitrary_file.yml
author: Matthew Matchen, Huntrule Team
date: 2020-09-04
modified: 2023-11-09
tags:
  - attack.stealth
  - attack.t1218
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName: MpCmdRun.exe
    - Image|endswith: \MpCmdRun.exe
    - CommandLine|contains: MpCmdRun.exe
    - Description: Microsoft Malware Protection Command Line Utility
  selection_cli:
    CommandLine|contains|all:
      - DownloadFile
      - url
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 46123129-1024-423e-9fae-43af4a0fa9a5
    type: derived