Ie4uinit.exe Proxy Execution from Unusual Path
Detects the use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file when ie4uinit.exe is not run from its usual system directories (C:\Windows\System32\ or C:\Windows\SysWOW64\). This behavior is indicative of an adversary attempting to bypass defenses by proxying execution with a trusted system binary.
Sigma
