Query.exe

Commands

1. ExecuteUser T1218

   Execute an arbitrary executable via trusted system executable.

   query.exe user

   Once executed, query.exe will execute quser.exe in the same folder. Thus, if query.exe is copied to a folder and an arbitrary executable is renamed to quser.exe, query.exe will spawn it. Instead of user, it is also possible to use session, termsession or process as command-line option.

   os: Windows 10, Windows 11

   Execute: EXERequires: Rename

Detection

• IOCquery.exe being executed and executes a child process outside of its normal path of c:\windows\system32\ or c:\windows\syswow64\