ie4uinit.exe

IE Per-User Initialization Utility file version info (xCyclopedia)

LOLBAS Execute 3 Sigma rules name it 1 ATT&CK technique 1 documented command 7 known copies with hashes

How ie4uinit.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

-basesettings

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for ie4uinit.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution User privileges

Executes commands from a specially prepared ie4uinit.inf file.

ie4uinit.exe -BaseSettings

Identify

The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for ie4uinit.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for ie4uinit.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumIe4uinit Lolbin Use From Invalid Pathfrack113

highPotential Defense Evasion Via Rename Of Highly Relevant BinariesMatthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113

lowPotential Executable Run Itself As Sacrificial Processfrack113

T1218System Binary Proxy Execution

Is it the real ie4uinit.exe?

file version info and known copies

Installed inC:\Windows\system32\

Signed byMicrosoft Windows

ProductInternet Explorer, Microsoft Corporation

DescriptionIE Per-User Initialization Utility

7 known copies

11.00.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ie4uinit.exe · signed by Microsoft Windows

7e258c54a58002c64ca0a951a48abf754a58ebcd8cb8777e74ef76b530d13db4

11.00.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\ie4uinit.exe · signed by Microsoft Windows

6f83621ed34b61ca0bbaff5a5fd158feeca364de52eec38e1cc2295a82a7bd5c

11.00.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\ie4uinit.exe · signed by Microsoft Windows

9e4365b2e2bedcaf66a12e11665962a617691643dfadaea53ac9732247f0e2b1

11.00.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ie4uinit.exe · signed by Microsoft Windows

856955eb4ebf79fd8c45b58e4271fb7f45f2659c88a5e94ba2d8e5484f4e9e11

11.00.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\ie4uinit.exe · signed by Microsoft Windows

46a3d721adb36114a5141e5795e4dfc02644fdf8f6c602bccfdc057784f29db0

11.00.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\ie4uinit.exe · signed by Microsoft Windows

dd7fe0dbd6bd3b66437c093b707d1b2ca8ac72e4671b88829a4327fa6b8a00bd

11.00.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\ie4uinit.exe · not signed

adff353bdcebbf38ee48a1255fbf1c7722758969f257188592538251d3bbb9b3

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.