runonce.exe

Run Once Wrapper file version info (xCyclopedia)

LOLBAS Execute 3 Sigma rules name it 1 ATT&CK technique 1 documented command 14 known copies with hashes

How runonce.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

-alternateshellstartup

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for runonce.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution Administrator privileges

Executes a Run Once Task that has been configured in the registry.

Runonce.exe /AlternateShellStartup

Identify

Trips 1 Sigma rule: lowRun Once Task Execution as Configured in Registry by Avneet Singh @v3t0_, oscd.community, Christopher Peacock @SecurePeacock (updated)

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for runonce.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for runonce.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

mediumSuspicious Rundll32 Setupapi.dll ActivityKonstantin Grishchenko, oscd.community

lowRun Once Task Execution as Configured in RegistryAvneet Singh @v3t0_, oscd.community, Christopher Peacock @SecurePeacock (updated)

T1218System Binary Proxy Execution

Is it the real runonce.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionRun Once Wrapper

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\runonce.exe · signed by Microsoft Windows

3d07b9ce8f703d536568378782f85d20541e0965b7a8947d6edb883cf7a25039

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\runonce.exe · signed by Microsoft Windows

8152d550176e103b3be1c0606fd1d869913af58a33d0af7d3c302a42a3d6ad1d

10.0.19041.1202 (WinBuild.160101.0800) · C:\Windows\SysWOW64\runonce.exe · signed by Microsoft Windows

4dbc301ea051ecdea35d26f7666ace0109cd8d1027c5361ec37e82623c0b5db4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\runonce.exe · signed by Microsoft Windows

25ea6b86f6e6cf516d048609cb37cd4d440e1fbca1bd15d2c0deecad1a8116ca

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\runonce.exe · signed by Microsoft Windows

5994e053d58db049f4bab2117c51cc314d1553bc6793ff000b232b66f709b0d7

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\runonce.exe · signed by Microsoft Windows

e2031017207a33a6fa147a5bb6e32ad5788df03f783d424a0053ba1b16d561f5

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\runonce.exe · signed by Microsoft Windows

60783bdf30b026d8fb92cbe6e2fa79e8352b38eabfd21f7e4310e3522888f33f

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\runonce.exe · signed by Microsoft Windows

645ac8acfe1973925e3bf1edaeaaf139b8b4da54ff6ca8b5f42e9ebc6940faa9

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\runonce.exe · signed by Microsoft Windows

78b8d920926ebcc685865a5ac91f21ed40889d538dde6a4092764f44d7c015f4

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\runonce.exe · signed by Microsoft Windows

e4afef687bcefb9a581299fb35946c869c6d0e000966e688589a48907c352432

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\runonce.exe · signed by Microsoft Windows

3a03f1d1ea3403cc2c81ca8f49e0330be7ac9e05ef5cd16352f12b43fb9e4e38

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\runonce.exe · signed by Microsoft Windows

4876620f993aade263fe29a7b92fe5723d02e0b02959e6f696ac0125570af2d4

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\runonce.exe · not signed

31f9a7fe6617b035df0fd6bf0b21fcd33528b4962c15af20ce617fdf0e57cf0a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\runonce.exe · not signed

d4f991adfdd1949ae08a106dad8a7899fef0bf5e691ac74099137fc5ffd9386f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.