Windows Process Creation: wlrmdr.exe with -u Flag or Uncommon Child Process Execution
Flags wlrmdr.exe launched with -u or uncommon children spawned with specific flags, using process creation telemetry.
- Product
- windows
- Category
- process_creation
- Author
- frack113, manasmbellani (SigmaHQ), DRL 1.1
- Published
- 2022-02-16
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies executions where wlrmdr.exe is launched with the -u command-line flag, which can pass attacker-controlled values to ShellExecute. It also flags cases where wlrmdr.exe spawns child processes using a set of uncommon argument flags, excluding events where the parent is winlogon.exe, empty, or null. The detection relies on Windows process creation telemetry including ParentImage, Image/OriginalFileName, and CommandLine contents.
Reporting behind it
- twitter.comhttps://twitter.com/0gtweet/status/1493963591745220608?s=20&t=xUg9DsZhJy1q9bPTUWgeIQ
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Wlrmdr/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wlrmdr_uncommon_child_process.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: wlrmdr.exe with -u Flag or Uncommon Child Process Execution"
id: f745c94e-812a-4a93-8ca0-827e9704a651
status: experimental
description: This rule identifies executions where wlrmdr.exe is launched with the -u command-line flag, which can pass attacker-controlled values to ShellExecute. It also flags cases where wlrmdr.exe spawns child processes using a set of uncommon argument flags, excluding events where the parent is winlogon.exe, empty, or null. The detection relies on Windows process creation telemetry including ParentImage, Image/OriginalFileName, and CommandLine contents.
references:
- https://twitter.com/0gtweet/status/1493963591745220608?s=20&t=xUg9DsZhJy1q9bPTUWgeIQ
- https://lolbas-project.github.io/lolbas/Binaries/Wlrmdr/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wlrmdr_uncommon_child_process.yml
author: frack113, manasmbellani, Huntrule Team
date: 2022-02-16
modified: 2025-10-31
tags:
- attack.stealth
- attack.t1218
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \wlrmdr.exe
selection_child_img:
- Image|endswith: \wlrmdr.exe
- OriginalFileName: WLRMNDR.EXE
selection_child_cli_flags_s:
CommandLine|contains|windash: "-s "
selection_child_cli_flags_f:
CommandLine|contains|windash: "-f "
selection_child_cli_flags_t:
CommandLine|contains|windash: "-t "
selection_child_cli_flags_m:
CommandLine|contains|windash: "-m "
selection_child_cli_flags_a:
CommandLine|contains|windash: "-a "
selection_child_cli_flags_u:
CommandLine|contains|windash: "-u "
filter_main_winlogon:
ParentImage: C:\Windows\System32\winlogon.exe
filter_main_empty:
ParentImage:
- ""
- "-"
filter_main_null:
ParentImage: null
condition: selection_parent or (all of selection_child_* and not 1 of filter_main_*)
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 9cfc00b6-bfb7-49ce-9781-ef78503154bb
type: derived