File Download And Execution Via IEExec.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects the execution of 'IEExec.exe' with command-line arguments containing 'http://' or 'https://', indicating an attempt to download and execute files from a remote web server. This utility is part of the .NET Framework and can be abused by adversaries for ingress tool transfer.