Windows Process Creation: Remote.exe Execution
Alerts on execution of remote.exe on Windows, which can be abused via a WinDbg/SDK binary for stealthy remote execution.
- Product
- windows
- Category
- process_creation
- Author
- Christopher Peacock @SecurePeacock, SCYTHE @scythe_io (SigmaHQ), DRL 1.1
- Published
- 2022-06-02
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation events where the executable name ends with \remote.exe or the OriginalFileName is remote.exe. Remote.exe is a Windows debugging/Windows SDK component (part of WinDbg) that can be abused to execute actions from remote content. Alerting on its execution matters because it can be used for stealthy or proxy-like execution patterns, and the rule relies on Windows process creation telemetry fields for image path and original file name.
Reporting behind it
- blog.thecybersecuritytutor.comhttps://blog.thecybersecuritytutor.com/Exeuction-AWL-Bypass-Remote-exe-LOLBin/
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/OtherMSBinaries/Remote/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_remote.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Remote.exe Execution"
id: 4e0bfe4e-6da1-484d-925b-f051d972c3ce
status: test
description: This rule identifies process creation events where the executable name ends with \remote.exe or the OriginalFileName is remote.exe. Remote.exe is a Windows debugging/Windows SDK component (part of WinDbg) that can be abused to execute actions from remote content. Alerting on its execution matters because it can be used for stealthy or proxy-like execution patterns, and the rule relies on Windows process creation telemetry fields for image path and original file name.
references:
- https://blog.thecybersecuritytutor.com/Exeuction-AWL-Bypass-Remote-exe-LOLBin/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Remote/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_remote.yml
author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io, Huntrule Team
date: 2022-06-02
tags:
- attack.execution
- attack.stealth
- attack.t1127
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \remote.exe
- OriginalFileName: remote.exe
condition: selection
falsepositives:
- Approved installs of Windows SDK with Debugging Tools for Windows (WinDbg).
level: medium
license: DRL-1.1
related:
- id: 4eddc365-79b4-43ff-a9d7-99422dc34b93
type: derived