Ie4uinit Lolbin Use From Invalid Path

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories

Known false positives

ViberPC updater calls this binary with the following commandline "ie4uinit.exe -ClearIconCache"

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218` System Binary Proxy Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Ie4uinit Lolbin Use From Invalid Path
id: d3bf399f-b0cf-4250-8bb4-dfc192ab81dc
status: test
description: Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/
    - https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/
author: frack113
date: 2022-05-07
modified: 2022-05-16
tags:
    - attack.stealth
    - attack.t1218
logsource:
    product: windows
    category: process_creation
detection:
    lolbin:
        - Image|endswith: '\ie4uinit.exe'
        - OriginalFileName: 'IE4UINIT.EXE'
    filter_correct:
        CurrentDirectory:
            - 'c:\windows\system32\'
            - 'c:\windows\sysWOW64\'
    filter_missing:
        CurrentDirectory: null
    condition: lolbin and not 1 of filter_*
falsepositives:
    - ViberPC updater calls this binary with the following commandline "ie4uinit.exe -ClearIconCache"
level: medium

Stages and Predicates

Stage 0: `condition`

lolbin and not 1 of filter_*

Stage 1: `lolbin`

lolbin:
    - Image|endswith: '\ie4uinit.exe'
    - OriginalFileName: 'IE4UINIT.EXE'

Stage 2: `not filter_*`

filter_correct:
    CurrentDirectory:
        - 'c:\windows\system32\'
        - 'c:\windows\sysWOW64\'
filter_missing:
    CurrentDirectory: null

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CurrentDirectory`	eq	`c:\windows\sysWOW64\`	`excludes:CurrentDirectory` `field:"CurrentDirectory" value:"c:\windows\sysWOW64\"`
`CurrentDirectory`	eq	`c:\windows\system32\`	`excludes:CurrentDirectory` `field:"CurrentDirectory" value:"c:\windows\system32\"`
`CurrentDirectory`	is_null	(no value, null check)	`excludes:CurrentDirectory`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\ie4uinit.exe`	`field:"Image" kind:ends_with value:"\ie4uinit.exe"`
`OriginalFileName`	eq	`IE4UINIT.EXE` corpus 3 (sigma 2, elastic 1)	`field:"OriginalFileName" kind:eq value:"IE4UINIT.EXE"`