Diagnostics Utility for Internet Explorer
set windir=c:\test& cd "C:\Program Files\Internet Explorer\" & iediagcmd.exe /out:c:\test\foo.cab
Executes binary that is pre-planted at C:\test\system32\netsh.exe.
Spawn a pre-planted executable from iediagcmd.exe.
C:\Program Files\Internet Explorer\iediagcmd.exe
Sigma: https://github.com/manasmbellani/mycode_public/blob/master/sigma/rules/win_proc_creation_lolbin_iediagcmd.yml, IOC: Sysmon Event ID 1, IOC: Execution of process iediagcmd.exe with /out could be suspicious
Adam (@hexacorn)