Microsoft Connection Manager Auto-Download
cmdl32 /vpn /lan %cd%\config
Download a file from the web address specified in the configuration file. The downloaded file will be in %TMP% under the name VPNXXXX.tmp where "X" denotes a random number or letter.
Download file from Internet
C:\Windows\System32\cmdl32.exe, C:\Windows\SysWOW64\cmdl32.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_cmdl32.yml, IOC: Reports of downloading from suspicious URLs in %TMP%\config.log, IOC: Useragent Microsoft(R) Connection Manager Vpn File Update
Elliot Killick (@elliotkillick)