huntrule

Windows Process Creation: wlrmdr.exe with -u Flag or Uncommon Child Process Execution

Flags wlrmdr.exe launched with -u or uncommon children spawned with specific flags, using process creation telemetry.

FreeUnreviewedSigmamediumv1
title: "Windows Process Creation: wlrmdr.exe with -u Flag or Uncommon Child Process Execution"
id: f745c94e-812a-4a93-8ca0-827e9704a651
status: experimental
description: This rule identifies executions where wlrmdr.exe is launched with the -u command-line flag, which can pass attacker-controlled values to ShellExecute. It also flags cases where wlrmdr.exe spawns child processes using a set of uncommon argument flags, excluding events where the parent is winlogon.exe, empty, or null. The detection relies on Windows process creation telemetry including ParentImage, Image/OriginalFileName, and CommandLine contents.
references:
  - https://twitter.com/0gtweet/status/1493963591745220608?s=20&t=xUg9DsZhJy1q9bPTUWgeIQ
  - https://lolbas-project.github.io/lolbas/Binaries/Wlrmdr/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wlrmdr_uncommon_child_process.yml
author: frack113, manasmbellani, Huntrule Team
date: 2022-02-16
modified: 2025-10-31
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \wlrmdr.exe
  selection_child_img:
    - Image|endswith: \wlrmdr.exe
    - OriginalFileName: WLRMNDR.EXE
  selection_child_cli_flags_s:
    CommandLine|contains|windash: "-s "
  selection_child_cli_flags_f:
    CommandLine|contains|windash: "-f "
  selection_child_cli_flags_t:
    CommandLine|contains|windash: "-t "
  selection_child_cli_flags_m:
    CommandLine|contains|windash: "-m "
  selection_child_cli_flags_a:
    CommandLine|contains|windash: "-a "
  selection_child_cli_flags_u:
    CommandLine|contains|windash: "-u "
  filter_main_winlogon:
    ParentImage: C:\Windows\System32\winlogon.exe
  filter_main_empty:
    ParentImage:
      - ""
      - "-"
  filter_main_null:
    ParentImage: null
  condition: selection_parent or (all of selection_child_* and not 1 of filter_main_*)
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9cfc00b6-bfb7-49ce-9781-ef78503154bb
    type: derived

What it detects

This rule identifies executions where wlrmdr.exe is launched with the -u command-line flag, which can pass attacker-controlled values to ShellExecute. It also flags cases where wlrmdr.exe spawns child processes using a set of uncommon argument flags, excluding events where the parent is winlogon.exe, empty, or null. The detection relies on Windows process creation telemetry including ParentImage, Image/OriginalFileName, and CommandLine contents.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.