cmdl32.exe

Microsoft Connection Manager Auto-Download file version info (xCyclopedia)

LOLBAS Download 1 Sigma rule name it 3 ATT&CK techniques 1 documented command 12 known copies with hashes

How cmdl32.exe is abused

documented by LOLBAS

Download T1105 Ingress Tool Transfer

-vpn

-lan

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for cmdl32.exe.

1 documented command

from LOLBAS, each read by the identifier

Download T1105 Ingress Tool Transfer User privileges

Download a file from the web address specified in the configuration file. The downloaded file will be in %TMP% under the name VPNXXXX.tmp where "X" denotes a random number or letter.

cmdl32 /vpn /lan %cd%\config

Identify

Trips 1 Sigma rule: mediumPotential Arbitrary File Download Via Cmdl32.EXE by frack113

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for cmdl32.exe, by Elliot Killick, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for cmdl32.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumPotential Arbitrary File Download Via Cmdl32.EXEfrack113

T1105Ingress Tool Transfer

T1202Indirect Command Execution

T1218System Binary Proxy Execution

Is it the real cmdl32.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft(R) Connection Manager, Microsoft Corporation

DescriptionMicrosoft Connection Manager Auto-Download

12 known copies

7.2.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\cmdl32.exe · signed by Microsoft Windows

335d472c81b05e6df922b5523fe026af2fcd48d025fa040f6896513c674f20d8

7.2.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\cmdl32.exe · signed by Microsoft Windows

498280e4610458825c48daa24811d0d326c6c227c50b6b3005a17946e8acc811

7.2.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\cmdl32.exe · signed by Microsoft Windows

28a7ff1ae045eb1fe7ed6a7dcd9b2212411c449a8afe0e652071af48beac610d

7.2.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cmdl32.exe · signed by Microsoft Windows

85b76de4b1e44d375df9d8d668b4bc4b91565a9bc652654c789a5ead6d5e1aec

7.2.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\cmdl32.exe · signed by Microsoft Windows

842eee57aec0d8ff489079eb086b091af253b10f74e9cf344cf0daeb6a838946

7.2.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\cmdl32.exe · signed by Microsoft Windows

f3fd2609c152ac0471ba72d929a16bdb7df888c92f7ef8f802664724628bd9c4

7.2.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cmdl32.exe · signed by Microsoft Windows

5f067f86ad0f88a629263162810bf5052f5ebbd97d5d0de936311bb44c9f35e7

7.2.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\cmdl32.exe · signed by Microsoft Windows

b12f21e80553cdd21de07ab3067e4f8ad026bea29efb6420b50e448cda852afe

7.2.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\cmdl32.exe · signed by Microsoft Windows

9489cb8520a6aea11fa6b1a2f019768417dc4963c1369cc87d4e1107c2ed788b

7.2.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\cmdl32.exe · signed by Microsoft Windows

de3435af48fc13b8a5ee92e2eceabbcd5c41f528f76396f38f334db5c975fa2b

7.02.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\cmdl32.exe · not signed

41d6a65ae50f7d01d5b641c062ffe3121ad8bfbf53acfc5631cb1410f8b17fb9

7.02.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\cmdl32.exe · not signed

9631159f2aaf4832d4e4df11054948c4a1439946e21c1680ff8b108274e59c6e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.