Windows Process Creation: remote.exe (WinDbg) Execution

Alerts on execution of remote.exe on Windows, which can be abused via a WinDbg/SDK binary for stealthy remote execution.

FreeUnreviewedSigmamediumv1

windows-process-creation-remote-exe-windbg-execution-4eddc365

title: "Windows Process Creation: remote.exe (WinDbg) Execution"
id: 4e0bfe4e-6da1-484d-925b-f051d972c3ce
status: test
description: This rule flags process creation events where the executable path ends with remote.exe or the OriginalFileName is remote.exe. Since remote.exe ships with the Windows SDK/WinDbg, attackers may leverage it as a living-off-the-land binary to run code with fewer obvious indicators. Detection relies on process creation telemetry that includes both the Image path and OriginalFileName fields.
references:
  - https://blog.thecybersecuritytutor.com/Exeuction-AWL-Bypass-Remote-exe-LOLBin/
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Remote/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_remote.yml
author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io, Huntrule Team
date: 2022-06-02
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \remote.exe
    - OriginalFileName: remote.exe
  condition: selection
falsepositives:
  - Approved installs of Windows SDK with Debugging Tools for Windows (WinDbg).
level: medium
license: DRL-1.1
related:
  - id: 4eddc365-79b4-43ff-a9d7-99422dc34b93
    type: derived

What it detects

This rule flags process creation events where the executable path ends with remote.exe or the OriginalFileName is remote.exe. Since remote.exe ships with the Windows SDK/WinDbg, attackers may leverage it as a living-off-the-land binary to run code with fewer obvious indicators. Detection relies on process creation telemetry that includes both the Image path and OriginalFileName fields.

Known false positives

Approved installs of Windows SDK with Debugging Tools for Windows (WinDbg).

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.