MpiExec Lolbin

Title: MpiExec Lolbin
Status: test
Description:Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary
References:
  -https://twitter.com/mrd0x/status/1465058133303246867
  -https://learn.microsoft.com/en-us/powershell/high-performance-computing/mpiexec?view=hpc19-ps
Author: Florian Roth (Nextron Systems)
Date: 2022-01-11
modified:2024-11-23
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_binary:
Image|endswith:'\mpiexec.exe' Hashes|contains:'IMPHASH=d8b52ef6aaa3a81501bdfff9dbb96217'   selection_flags:
    CommandLine|contains:
      -' /n 1 '
      -' -n 1 '

  condition:all of selection*
Falsepositives:
  -Unknown
Level: high