Windows Process Creation: wlrmdr.exe with -u Flag or Uncommon Child Process Execution

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies executions where wlrmdr.exe is launched with the -u command-line flag, which can pass attacker-controlled values to ShellExecute. It also flags cases where wlrmdr.exe spawns child processes using a set of uncommon argument flags, excluding events where the parent is winlogon.exe, empty, or null. The detection relies on Windows process creation telemetry including ParentImage, Image/OriginalFileName, and CommandLine contents.

Reporting behind it

Related detections9 linkedT1218 — drag to rearrange

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

Malicious DLL Execution via Wuauclt Update Handler (via process_creation)

Malicious aspnet_compiler.exe Injection Host Spawned by PowerShell via process_creation

Malicious regsvcs LOLBin Loading Ransomware DLL from UNC Path

Suspicious RegAsm or RegSvcs Spawned by Script Host (via process_creation)

Suspicious Extexport DLL Side-Loading Execution

Malicious ClickFix Execution Chain Spawning MSHTA via Pcalua on EtherRAT Infection

Suspicious TALONITE Certutil LOLBIN Decode and Download Abuse (via process_creation)

Suspicious Renamed git Binary gcmd.exe Execution (via process_creation)

Windows Process Creation: wlrmdr.exe with -u Flag or Uncommon Child Process Execution

Pivot detection · T1218 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-wlrmdr-exe-with-u-flag-or-uncommon-child-process-execut-9cfc00b6

title: "Windows Process Creation: wlrmdr.exe with -u Flag or Uncommon Child Process Execution"
id: f745c94e-812a-4a93-8ca0-827e9704a651
status: experimental
description: This rule identifies executions where wlrmdr.exe is launched with the -u command-line flag, which can pass attacker-controlled values to ShellExecute. It also flags cases where wlrmdr.exe spawns child processes using a set of uncommon argument flags, excluding events where the parent is winlogon.exe, empty, or null. The detection relies on Windows process creation telemetry including ParentImage, Image/OriginalFileName, and CommandLine contents.
references:
  - https://twitter.com/0gtweet/status/1493963591745220608?s=20&t=xUg9DsZhJy1q9bPTUWgeIQ
  - https://lolbas-project.github.io/lolbas/Binaries/Wlrmdr/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wlrmdr_uncommon_child_process.yml
author: frack113, manasmbellani, Huntrule Team
date: 2022-02-16
modified: 2025-10-31
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \wlrmdr.exe
  selection_child_img:
    - Image|endswith: \wlrmdr.exe
    - OriginalFileName: WLRMNDR.EXE
  selection_child_cli_flags_s:
    CommandLine|contains|windash: "-s "
  selection_child_cli_flags_f:
    CommandLine|contains|windash: "-f "
  selection_child_cli_flags_t:
    CommandLine|contains|windash: "-t "
  selection_child_cli_flags_m:
    CommandLine|contains|windash: "-m "
  selection_child_cli_flags_a:
    CommandLine|contains|windash: "-a "
  selection_child_cli_flags_u:
    CommandLine|contains|windash: "-u "
  filter_main_winlogon:
    ParentImage: C:\Windows\System32\winlogon.exe
  filter_main_empty:
    ParentImage:
      - ""
      - "-"
  filter_main_null:
    ParentImage: null
  condition: selection_parent or (all of selection_child_* and not 1 of filter_main_*)
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9cfc00b6-bfb7-49ce-9781-ef78503154bb
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL