Work Folders Located at: C:\Windows\System32\WorkFolders.exe.
workfoldersworkfoldersSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Execute `control.exe` in the current working directory (Can be used to evade defensive countermeasures or to hide as a persistence mechanism)
WorkFolders`WorkFolders` attempts to execute `control.exe`. By modifying the default value of the App Paths registry key for `control.exe` in `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\control.exe`, an attacker can achieve proxy execution. (Proxy execution of a malicious payload via App Paths registry hijacking.)
WorkFolders| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_susp_workfolders.yml |
| ioc | WorkFolders.exe should not be run on a normal workstation |
| ioc | Registry modification to HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\control.exe |
workfolders is a Windows LOLBin. Work Folders Located at: C:\Windows\System32\WorkFolders.exe.