Remote.exe

Commands

1. AWL BypassUser T1127

   Executes a process under a trusted Microsoft signed binary

   Remote.exe /s {PATH:.exe} anythinghere

   Spawns specified executable as a child process of remote.exe

   os: Windows

   Execute: EXE

2. ExecuteUser T1127

   Executes a process under a trusted Microsoft signed binary

   Remote.exe /s {PATH:.exe} anythinghere

   Spawns specified executable as a child process of remote.exe

   os: Windows

   Execute: EXE

3. ExecuteUser T1127

   Executing a remote binary without saving file to disk

   Remote.exe /s {PATH_SMB:.exe} anythinghere

   Run a remote file

   os: Windows

   Execute: EXEExecute: Remote

Detection

• IOCremote.exe process spawns
• Sigma https://github.com/SigmaHQ/sigma/blob/197615345b927682ab7ad7fa3c5f5bb2ed911eed/rules/windows/process_creation/proc_creation_win_lolbin_remote.yml

Resources

• https://blog.thecybersecuritytutor.com/Exeuction-AWL-Bypass-Remote-exe-LOLBin/