Diagnostics Utility for Internet Explorer Located at: C:\Program Files\Internet Explorer\iediagcmd.exe.
iediagcmdiediagcmdSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Executes binary that is pre-planted at C:\test\system32\netsh.exe. (Spawn a pre-planted executable from iediagcmd.exe.)
set windir=c:\test& cd "C:\Program Files\Internet Explorer\" & iediagcmd.exe /out:{PATH_ABSOLUTE:.cab}| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/manasmbellani/mycode_public/blob/master/sigma/rules/win_proc_creation_lolbin_iediagcmd.yml |
| ioc | Sysmon Event ID 1 |
| ioc | Execution of process iediagcmd.exe with /out could be suspicious |
iediagcmd is a Windows LOLBin. Diagnostics Utility for Internet Explorer Located at: C:\Program Files\Internet Explorer\iediagcmd.exe.