File Download Via Windows Defender MpCmpRun.EXE

Title: File Download Via Windows Defender MpCmpRun.EXE
Status: test
Description:Detects the use of Windows Defender MpCmdRun.EXE to download files
References:
  -https://web.archive.org/web/20200903194959/https://twitter.com/djmtshepana/status/1301608169496612866
  -https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/
Author: Matthew Matchen
Date: 2020-09-04
modified:2023-11-09
Tags:

• -'attack.stealth'
• -'attack.t1218'
• -'attack.command-and-control'
• -'attack.t1105'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
OriginalFileName:'MpCmdRun.exe' Image|endswith:'\MpCmdRun.exe' CommandLine|contains:'MpCmdRun.exe' Description:'Microsoft Malware Protection Command Line Utility'   selection_cli:
    CommandLine|contains|all:
      -'DownloadFile'
      -'url'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high