LOL · Binary

wt.exe

1 technique WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Execute a command via Windows Terminal.

Use Use wt.exe as a proxy binary to evade defensive counter-measures

wt.exe {CMD}

Context: user
Native: Execute
MITRE: T1202
Detection: Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_windows_terminal_susp_children.yml
Refs: twitter.com/nas_bench/status/1552100271668469761
lolbas-project.github.io/lolbas/Binaries/wt/