wt.exe

type: OSBinaries

Windows Terminal

Full path

C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_<version_packageid>\wt.exe

Commands

ExecuteUser T1202
Use wt.exe as a proxy binary to evade defensive counter-measures
```
wt.exe {CMD}
```
Execute a command via Windows Terminal.
os: Windows 11
Execute: CMD

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_windows_terminal_susp_children.yml

Resources

https://twitter.com/nas_bench/status/1552100271668469761

acknowledgement: Nasreddine Bencherchali @nas_bench