Skip to content

LIVING OFF THE LAND / OS BINARIES

Reset.exe

Remote Desktop Services Reset Utility

01COMMAND EXAMPLES

01ATT&CK TECHNIQUES

00DETECTION RESOURCES

01CAPABILITIES

01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Once executed, `reset.exe` will execute `rwinsta.exe` in the same folder. Thus, if `reset.exe` is copied to a folder and an arbitrary executable is renamed to `rwinsta.exe`, `reset.exe` will spawn it.

COMMAND

reset.exe session

USE CASE: Execute an arbitrary executable via trusted system executable.
PRIVILEGES: User
OPERATING SYSTEM: Windows 10, Windows 11

Execute · EXERequires · Rename

02 / ON DISK

Known paths

c:\windows\system32\reset.exe

c:\windows\syswow64\reset.exe

03 / DEFENSIVE INTELLIGENCE

Detection & indicators

0 resources

Indicators & detection notes

IOC
reset.exe being executed and executes rwinsta.exe outside of its normal path of c:\windows\system32\ or c:\windows\syswow64\

COMMUNITY RESEARCH

Acknowledgements

Matan Bahar@Bl4ckShad3