Query.exe

Once executed, `query.exe` will execute `quser.exe` in the same folder. Thus, if `query.exe` is copied to a folder and an arbitrary executable is renamed to `quser.exe`, `query.exe` will spawn it. Instead of `user`, it is also possible to use `session`, `termsession` or `process` as command-line option.

Use Execute an arbitrary executable via trusted system executable.

query.exe user

Context

user

Native

Execute

MITRE

T1218

Detection

IOC: query.exe being executed and executes a child process outside of its normal path of c:\windows\system32\ or c:\windows\syswow64\

Refs

lolbas-project.github.io/lolbas/Binaries/Query/