Debugging tool included with Windows Debugging Tools Located at: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\remote.exe; C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\remote.exe.
remoteremoteSandbox: execFile · Timeout: 30s
security.defense-evasion.bypass security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Spawns specified executable as a child process of remote.exe (Executes a process under a trusted Microsoft signed binary)
Remote.exe /s {PATH:.exe} anythinghereSpawns specified executable as a child process of remote.exe (Executes a process under a trusted Microsoft signed binary)
Remote.exe /s {PATH:.exe} anythinghereRun a remote file (Executing a remote binary without saving file to disk)
Remote.exe /s {PATH_SMB:.exe} anythinghere| Type | Rule / Indicator |
|---|---|
| ioc | remote.exe process spawns |
| sigma | https://github.com/SigmaHQ/sigma/blob/197615345b927682ab7ad7fa3c5f5bb2ed911eed/rules/windows/process_creation/proc_creation_win_lolbin_remote.yml |
remote is a Windows LOLBin. Debugging tool included with Windows Debugging Tools Located at: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\remote.exe; C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\remote.exe.