Query commonly abused binaries

When you’re hunting for a copied or renamed Windows binary, FileName only tells part of the story. The file’s version information can give you another way to find it.

Here’s a small Defender advanced hunting query for ie4uinit.exe running outside C:\Windows\System32\, including renamed copies whose original-file-name metadata is still present:

DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessVersionInfoOriginalFileName =~ "ie4uinit.exe"
| where FolderPath !startswith @"C:\Windows\System32\"
| project Timestamp, DeviceName, FileName, FolderPath,
          ProcessCommandLine, InitiatingProcessFileName,
          InitiatingProcessCommandLine, SHA1

Microsoft documents ProcessVersionInfoOriginalFileName as metadata from the newly created process. The =~ comparison makes the filename check case-insensitive; the original tweet used ==.

LOLBAS documents how ie4uinit.exe can execute commands from a specially prepared INF file, which makes unusual locations worth investigating.

But a result needs context. The query also includes the legitimate SysWOW64 location, and the hard-coded C:\Windows path may need adjusting for your environment. Review the command line, parent process, account, and surrounding activity before deciding it’s malicious.

Version metadata can be missing or changed, so this won’t find every renamed copy. It also doesn’t establish whether a file is signed. You’ll need Defender for Endpoint telemetry populating DeviceProcessEvents for the query to return data.

Use this as a starting point for a hunt, then tune it against what you find.

Original post: 2 December 2024. Documentation checked 14 October 2026.