Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

Arbitrary File Download Via IMEWDBLD.EXE

Detects usage of "IMEWDBLD.exe" to download arbitrary files

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Swachchhanda Shrawan PoudelCreated Thu Nov 09863218bd-c7d0-4c52-80cd-0a96c09f54afwindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic2 selectors
detection:
    selection_img:
        - Image|endswith: '\IMEWDBLD.exe'
        - OriginalFileName: 'imewdbld.exe'
    selection_cli:
        CommandLine|contains:
            - 'http://'
            - 'https://'
    condition: all of selection_*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
github.com
2
Resolving title…
lolbas-project.github.io
MITRE ATT&CK
Related Rules
DerivedDetectionhigh

Network Connection Initiated By IMEWDBLD.EXE

Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata
Rule ID
863218bd-c7d0-4c52-80cd-0a96c09f54af
Status
test
Level
high
Type
Detection
Created
Thu Nov 09
Author
Swachchhanda Shrawan Poudel
Path
rules/windows/process_creation/proc_creation_win_imewbdld_download.yml
Raw Tags
attack.defense-evasionattack.executionattack.t1218
View on GitHub