write.exe

type: OSBinaries

Windows Write

Full path

C:\Windows\write.exe
C:\Windows\System32\write.exe
C:\Windows\SysWOW64\write.exe

Commands

ExecuteUser T1218
Execute binary through legitimate proxy. This might be utilized to confuse detection solutions that rely on parent-child relationships.
```
write.exe
```
Executes a binary provided in default value of HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\wordpad.exe.
os: Windows 10, Windows 11 (before 24H2)
Execute: EXERequires: Registry Change

Detection

IOCChanges to HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\wordpad.exe
Sigma https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_app_paths.yml

Resources

https://gist.github.com/mblzk/b8c5ff7c2bd0fb2b385cc2fdd119874b

acknowledgement: Michal Belzak