LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Wlrmdr.exe

View source

Windows Logon Reminder executable

01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1202

Execute executable with wlrmdr.exe as parent process

COMMAND
wlrmdr.exe -s 3600 -f 0 -t _ -m _ -a 11 -u {PATH:.exe}
USE CASE
Use wlrmdr as a proxy binary to evade defensive countermeasures
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · EXE
02 / ON DISK

Known paths

c:\windows\system32\wlrmdr.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    wlrmdr.exe spawning any new processes

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Grzegorz Tworek@0gtweet
Oddvar Moe@Oddvarmoe
Freddy@falsneg