Repository navigation
Conversation
MpCmdRun.exe -DeviceControl -TestPolicyXml <file> -Rules reads any user-accessible file and dumps its full contents to %TEMP%\MpCmdRun.log. No admin required. The file is passed to an internal XML parser which fails for non-XML input, but the raw content is written to the log. Tested on Windows 11 Enterprise with MDE 4.18.26100.4 and Tamper Protection level 5. Zero alerts generated. High-value targets confirmed: SSH private keys (full PEM dump), Chrome/Edge Local State (DPAPI encrypted_key for browser credential decryption), SSH config (network target mapping), Wi-Fi profile XMLs (keyMaterial), and PowerShell command history. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a new technique for
MpCmdRun.exeusing the-DeviceControl -TestPolicyXmlflag to read arbitrary user-accessible files.Command:
MpCmdRun.exe -DeviceControl -TestPolicyXml {PATH_TO_FILE} -RulesThe file contents are dumped to
%TEMP%\MpCmdRun.log(UTF-16LE). The internal XML parser fails on non-XML input, but the raw file content is written to the log before the parse error. No admin privileges required.Verified targets
Tested on Windows 11 Enterprise, MDE 4.18.26100.4, Tamper Protection level 5. Zero security alerts generated across all tests.
~/.ssh/id_rsa)encrypted_key(DPAPI) extracted — enables offline browser credential decryption~/.ssh/config)ProgramData\Wlansvc\Profiles\*.xml)ConsoleHost_history.txt)Text files are fully dumped. Binary files (SQLite databases) are truncated to ~1KB.
Why this qualifies
-DeviceControl -TestPolicyXmlis intended for testing Device Control policies, not reading arbitrary filesCategory
Credentials (T1552.001 — Unsecured Credentials: Credentials in Files)
Detection IOCs added
-DeviceControl -TestPolicyXmlarguments where the target is not an XML policy file%TEMP%\MpCmdRun.logcontaining non-XML content (PEM keys, JSON, plaintext credentials)Note on existing -DownloadFile entries
The
-DownloadFileflag was removed by Microsoft in MpCmdRun v4.18.26100.4. The existing Download entries may need a version note, but that is out of scope for this PR.