LOLBin application launcher
A signed Microsoft utility used as a launcher for an arbitrary program, so the real payload runs as that utility's child instead of appearing on its own.
What it detects
A signed Microsoft utility used as a launcher for an arbitrary program, so the real payload runs as that utility's child instead of appearing on its own.
Covered here: * pcalua.exe -a — the Program Compatibility Assistant's run-a-program flag * msxsl.exe — an XSL transform host that executes embedded script * vshadow.exe -exec= — a VSS tool that runs a program against a snapshot * desktopimgdownldr /lockscreenurl: — downloads an arbitrary URL to disk * forfiles /c — runs a command per matched file * explorer.exe /root, — launches a target through Explorer, orphaning the child
Each is a documented feature. What makes the set worth alerting on is that they are all indirection: a detection or policy that watches for a payload's own process name never sees it.
MITRE ATT&CK mapping
- T1218System Binary Proxy Execution· Defense Evasion
False positives and triage
forfiles /c is the one with real benign use — it appears in administrative cleanup scripts and scheduled maintenance. Treat a forfiles hit as low signal on its own and rely on what it runs.
To confirm: read what is being launched. A path under \Users\, \Temp\, \ProgramData\, a network share, or an interpreter (cmd, powershell, wscript) is the finding; a vendor binary under Program Files invoked by a maintenance account is probably not. desktopimgdownldr /lockscreenurl: pointing anywhere other than a Microsoft domain is a download to disk and should be treated as ingress regardless of what runs afterwards.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 75%. Source: rules/windows/lolbin_application_launcher.yaml, licensed under the Apache License 2.0.
id: windows.execution.lolbin_application_launcher
version: 1.0.0
status: stable
severity: high
confidence: 0.75
platforms: [windows]
mitre_techniques: [T1218]
description: |
A signed Microsoft utility used as a launcher for an arbitrary program, so the
real payload runs as that utility's child instead of appearing on its own.
Covered here:
* `pcalua.exe -a` — the Program Compatibility Assistant's run-a-program flag
* `msxsl.exe` — an XSL transform host that executes embedded script
* `vshadow.exe -exec=` — a VSS tool that runs a program against a snapshot
* `desktopimgdownldr /lockscreenurl:` — downloads an arbitrary URL to disk
* `forfiles /c` — runs a command per matched file
* `explorer.exe /root,` — launches a target through Explorer, orphaning the child
Each is a documented feature. What makes the set worth alerting on is that they
are all indirection: a detection or policy that watches for a payload's own
process name never sees it.
match:
command_line_regex: '(?i)(pcalua(\.exe)?"?\s+-a\s|\bmsxsl(\.exe)?"?\s|vshadow(\.exe)?"?\s[^|]*-exec=|desktopimgdownldr(\.exe)?"?\s[^|]*/lockscreenurl:|forfiles(\.exe)?"?\s[^|]*/c\s|explorer(\.exe)?"?\s+/root,)'
correlation_keys: [hostname, user_name]
false_positive_guidance: |
`forfiles /c` is the one with real benign use — it appears in administrative
cleanup scripts and scheduled maintenance. Treat a `forfiles` hit as low signal on
its own and rely on what it runs.
To confirm: read what is being launched. A path under `\Users\`, `\Temp\`,
`\ProgramData\`, a network share, or an interpreter (`cmd`, `powershell`,
`wscript`) is the finding; a vendor binary under `Program Files` invoked by a
maintenance account is probably not. `desktopimgdownldr /lockscreenurl:` pointing
anywhere other than a Microsoft domain is a download to disk and should be treated
as ingress regardless of what runs afterwards.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.