MpiExec LOLBIN Execution

SigmaHQ Detections@sigmaHQ

•updated Nov 25, 2024•0•12

Detects the execution of 'mpiexec.exe' from the HPC pack with specific command-line flags ('/n 1' or '-n 1'). This combination indicates an attempt to abuse 'mpiexec.exe' as a LOLBIN (Living Off the Land Binary) to proxy the execution of other binaries, potentially bypassing security controls.