Identifier / Programs / Windows
remote.exe
Microsoft Remote Std I/O Shell file version info (xCyclopedia)
LOLBAS AWL Bypass, Execute 1 Sigma rule name it 1 ATT&CK technique 3 documented commands 3 known copies with hashes
How remote.exe is abused
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for remote.exe.
3 documented commands
AWL Bypass T1127 Trusted Developer Utilities Proxy Execution User privileges
Spawns specified executable as a child process of remote.exe
Remote.exe /s {PATH:.exe} anythinghereTrips 1 Sigma rule: mediumUse of Remote.exe by Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
Execute T1127 Trusted Developer Utilities Proxy Execution User privileges
Spawns specified executable as a child process of remote.exe
Remote.exe /s {PATH:.exe} anythinghereTrips 1 Sigma rule: mediumUse of Remote.exe by Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
Execute T1127 Trusted Developer Utilities Proxy Execution User privileges
Run a remote file
Remote.exe /s {PATH_SMB:.exe} anythinghereTrips 1 Sigma rule: mediumUse of Remote.exe by Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
All 3 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for remote.exe, by mr.d0x, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for remote.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real remote.exe?
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\3 known copies
10.0.19041.1 · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\remote.exe · signed by Microsoft Corporation
74f00da9e4128282f502cf3ae67a139b723f2c3c00e5141b7b60e8eed1f3bf6a10.0.19041.1 · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\remote.exe · signed by Microsoft Windows Kits Publisher
cf9c06154235fab5d6b67f742b2d2df0304411763e8c8c8530c524b6d13975e210.0.19041.1 · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\remote.exe · signed by Microsoft Corporation
d3e433d4595eb2240edc914c67ab85d9308bcfc903b185302fe3bc52215c5e6bFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.