Identifier / Programs / Windows
reset.exe
Resets DiskShadow.exe to the default state. Windows commands reference
LOLBAS Execute 1 ATT&CK technique 1 documented command 9 known copies with hashes
How reset.exe is abused
Execute T1218 System Binary Proxy Execution
session
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for reset.exe.
1 documented command
Execute T1218 System Binary Proxy Execution User privileges
Once executed, reset.exe will execute rwinsta.exe in the same folder. Thus, if reset.exe is copied to a folder and an arbitrary executable is renamed to rwinsta.exe, reset.exe will spawn it.
reset.exe sessionThe command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for reset.exe, by Matan Bahar, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for reset.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real reset.exe?
C:\Windows\system32\C:\Windows\SysWOW64\9 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\reset.exe · signed by Microsoft Windows
12644c9866833dccf8f462044ac8aedcbb4ab5fcd78efb82c356d0ce5726624310.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\reset.exe · signed by Microsoft Windows
0f45ee243cdc2aaec85dc18b686a86b18d3416729751f273fc094da0a5bccf0710.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\reset.exe · signed by Microsoft Windows
0bcb46894104bc7ed6a6e5062bb340a0707d8282ab75387fbf6f3fbeb0696a9710.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\reset.exe · signed by Microsoft Windows
c1e2a96b5d73d08a52bc5a2e634d408c2d42071147d40a894c8b4606de83484d10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\reset.exe · signed by Microsoft Windows
ef8641fdcbc876e51ceaa2fff825d3e25a57b8694433fff58588a6f35fa1790810.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\reset.exe · signed by Microsoft Windows
805554e4639a1ba34926feabbd25bdcea3771a3b5a8f91e70c1ff3bab8b772f410.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\reset.exe · signed by Microsoft Windows
8b669a5ef2a3ccf1c0f2dde0a0d6a0c4ea935afe582ca46f10c5b5e2a7df5bd96.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\reset.exe · not signed
73e255675371774c25ad4717d5564e137ef70b087ec1f4767ab11ebb275328ab6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\reset.exe · not signed
a07b90834efb0e2eea532eaa97f5254dfcb688166afbc7e845f3e8c32025c21cFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.