Windows Process Creation: MpCmdRun.EXE Used to Download Files via DownloadFile url
Alerts when MpCmdRun.exe is executed with DownloadFile and url, indicating Defender utility file download behavior.
- Product
- windows
- Category
- process_creation
- Author
- Matthew Matchen (SigmaHQ), DRL 1.1
- Published
- 2020-09-04
- Updated
- 2026-07-30
ATT&CK techniques
Defense Evasion → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags process creation events where Windows Defender’s MpCmdRun.exe is launched and its command line includes the DownloadFile action with a url parameter. Attackers may abuse built-in security utilities to blend in with legitimate activity while retrieving remote payloads. The detection relies on process creation telemetry, specifically the original executable name, the process image path, and command-line contents matching DownloadFile and url.
Reporting behind it
- web.archive.orghttps://web.archive.org/web/20200903194959/https://twitter.com/djmtshepana/status/1301608169496612866
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mpcmdrun_download_arbitrary_file.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: MpCmdRun.EXE Used to Download Files via DownloadFile url"
id: 161c37ab-7ce7-4c93-aff5-4764f5df71ed
status: test
description: This rule flags process creation events where Windows Defender’s MpCmdRun.exe is launched and its command line includes the DownloadFile action with a url parameter. Attackers may abuse built-in security utilities to blend in with legitimate activity while retrieving remote payloads. The detection relies on process creation telemetry, specifically the original executable name, the process image path, and command-line contents matching DownloadFile and url.
references:
- https://web.archive.org/web/20200903194959/https://twitter.com/djmtshepana/status/1301608169496612866
- https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mpcmdrun_download_arbitrary_file.yml
author: Matthew Matchen, Huntrule Team
date: 2020-09-04
modified: 2023-11-09
tags:
- attack.stealth
- attack.t1218
- attack.command-and-control
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection_img:
- OriginalFileName: MpCmdRun.exe
- Image|endswith: \MpCmdRun.exe
- CommandLine|contains: MpCmdRun.exe
- Description: Microsoft Malware Protection Command Line Utility
selection_cli:
CommandLine|contains|all:
- DownloadFile
- url
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 46123129-1024-423e-9fae-43af4a0fa9a5
type: derived