Detection rules › Sigma

Ie4uinit Lolbin Use From Invalid Path

Severity
medium
Author
frack113
Source
upstream

Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1218 System Binary Proxy Execution

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: lolbin

or:
Image|endswith: '\ie4uinit.exe'
OriginalFileName: IE4UINIT.EXE

Stage 2: not 1 of filter_*

or:
CurrentDirectory: 'c:\windows\sysWOW64\'
CurrentDirectory: 'c:\windows\system32\'
CurrentDirectory: null

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CurrentDirectoryeq
  • c:\windows\sysWOW64\
  • c:\windows\system32\
Imageends_with
  • \ie4uinit.exe corpus 2 (sigma 2)
OriginalFileNameeq
  • IE4UINIT.EXE corpus 2 (sigma 2)