Remote Desktop Services MultiUser Query Utility Located at: c:\windows\system32\query.exe; c:\windows\syswow64\query.exe.
queryquerySandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Once executed, `query.exe` will execute `quser.exe` in the same folder. Thus, if `query.exe` is copied to a folder and an arbitrary executable is renamed to `quser.exe`, `query.exe` will spawn it. Instead of `user`, it is also possible to use `session`, `termsession` or `process` as command-line option. (Execute an arbitrary executable via trusted system executable.)
query.exe user| Type | Rule / Indicator |
|---|---|
| ioc | query.exe being executed and executes a child process outside of its normal path of c:\windows\system32\ or c:\windows\syswow64\ |
query is a Windows LOLBin. Remote Desktop Services MultiUser Query Utility Located at: c:\windows\system32\query.exe; c:\windows\syswow64\query.exe.