Identifier / Programs / Windows
runexehelper.exe
LOLBAS Execute 1 ATT&CK technique 1 documented command 9 known copies with hashes
How runexehelper.exe is abused
Execute T1218 System Binary Proxy Execution
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for runexehelper.exe.
1 documented command
Execute T1218 System Binary Proxy Execution User privileges
Launches the specified exe. Prerequisites: (1) diagtrack_action_output environment variable must be set to an existing, writable folder; (2) runexewithargs_output.txt file cannot exist in the folder indicated by the variable.
runexehelper.exe {PATH_ABSOLUTE:.exe}The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for runexehelper.exe, by Grzegorz Tworek, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for runexehelper.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real runexehelper.exe?
C:\Windows\system32\9 known copies
Version not recorded · C:\Windows\system32\runexehelper.exe · signed by Microsoft Windows
096315a55905f932c280d17506151fd027328bb9c6e6399e1efd7a6adbc358caVersion not recorded · C:\WINDOWS\system32\runexehelper.exe · signed by Microsoft Windows
0df360861630d7fcce04ae96f924955185bc8053aad9627ba96e714464f0fffcVersion not recorded · C:\Windows\system32\runexehelper.exe · signed by Microsoft Windows
2751182a7f84c4eae674a9d25084baec7c1d7ffa427921b7a051e333218a6703Version not recorded · C:\Windows\system32\runexehelper.exe · signed by Microsoft Windows
3424faf87604930daeb0f98bd820e9288422bb847471993d927a8c77f345fdb6Version not recorded · C:\Windows\system32\runexehelper.exe · signed by Microsoft Windows
5104141ace221af9147cafba8bd0087a699b69b3373ad48992018e42c0ee5844Version not recorded · C:\Windows\system32\runexehelper.exe · signed by Microsoft Windows
8485b0a140af4e1a83526db121f95d866ba51a1e6092d61b7e78e32ebbb0e228Version not recorded · C:\WINDOWS\system32\runexehelper.exe · signed by Microsoft Windows
cecb11d023a835ac717c6ca9178a18b0fa544e75150fda02aacdc2a39eb21c6aVersion not recorded · C:\Windows\system32\runexehelper.exe · signed by Microsoft Windows
d0426ae4bdf1c4910aba092396bb1d55eabbd8246b2977cf069d1bde0711cd4bVersion not recorded · C:\Windows\system32\runexehelper.exe · signed by Microsoft Windows
d8cdb77b50d7754235e12b28c25eb014c9131d586605ed02250df9bd9e206e09From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.