Reset.exe

Commands

1. ExecuteUser T1218

   Execute an arbitrary executable via trusted system executable.

   reset.exe session

   Once executed, reset.exe will execute rwinsta.exe in the same folder. Thus, if reset.exe is copied to a folder and an arbitrary executable is renamed to rwinsta.exe, reset.exe will spawn it.

   os: Windows 10, Windows 11

   Execute: EXERequires: Rename

Detection

• IOCreset.exe being executed and executes rwinsta.exe outside of its normal path of c:\windows\system32\ or c:\windows\syswow64\