Wlrmdr.EXE Unusual Argument Or Child Process (via process_creation)

title: Wlrmdr.EXE Unusual Argument Or Child Process (via process_creation)
id: 0b878f41-fa20-50e8-b393-305041606abc
status: stable
description: This rule detects the execution of "Wlrmdr.exe" with the "-u" command line flag which enables anything passed to it to be an argument of the ShellExecute API, which would enable an adversary to execute arbitrary binaries. This detection also focuses on any uncommon child processes spawned from "Wlrmdr.exe" as a supplement for those that posses "ParentImage" telemetry.
references:
    - https://attack.mitre.org/techniques/T1218/
    - https://twitter.com/0gtweet/status/1493963591745220608?s=20&t=xUg9DsZhJy1q9bPTUWgeIQ
    - https://lolbas-project.github.io/lolbas/Binaries/Wlrmdr/
author: Huntrule Team
date: 2026-06-09
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\wlrmdr.exe'
    selection_child_img:
        - Image|endswith: '\wlrmdr.exe'
        - OriginalFileName: 'WLRMNDR.EXE'
    selection_child_cli_flags_s:
        CommandLine|contains|windash: '-s '
    selection_child_cli_flags_f:
        CommandLine|contains|windash: '-f '
    selection_child_cli_flags_t:
        CommandLine|contains|windash: '-t '
    selection_child_cli_flags_m:
        CommandLine|contains|windash: '-m '
    selection_child_cli_flags_a:
        CommandLine|contains|windash: '-a '
    selection_child_cli_flags_u:
        CommandLine|contains|windash: '-u '
    filter_main_winlogon:
        ParentImage: 'C:\Windows\System32\winlogon.exe'
    filter_main_empty:
        ParentImage:
            - ''
            - '-'
    filter_main_null:
        ParentImage:
    condition: selection_parent or (all of selection_child_* and not 1 of filter_main_*)
falsepositives:
    - Unknown
level: medium