Arbitrary File Download Via IMEWDBLD.exe

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2024•0•19

Detects the use of 'IMEWDBLD.exe', a legitimate Microsoft binary, to download arbitrary files from HTTP or HTTPS sources. This technique is often abused by adversaries for ingress tool transfer or to fetch additional malicious payloads, leveraging a trusted binary to bypass defenses.