Identifier / Programs / Windows

wlrmdr.exe

Windows logon reminder file version info (xCyclopedia)

LOLBAS Execute 1 Sigma rule name it 2 ATT&CK techniques 1 documented command 7 known copies with hashes

How wlrmdr.exe is abused

documented by LOLBAS

Execute T1202 Indirect Command Execution

-s

-f

-t

-m

-a

-u

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for wlrmdr.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1202 Indirect Command Execution User privileges

Execute executable with wlrmdr.exe as parent process

wlrmdr.exe -s 3600 -f 0 -t _ -m _ -a 11 -u {PATH:.exe}

Identify

The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for wlrmdr.exe, by Moshe Kaplan, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for wlrmdr.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumWlrmdr.EXE Uncommon Argument Or Child Processfrack113, manasmbellani

T1202Indirect Command Execution

T1218System Binary Proxy Execution

Is it the real wlrmdr.exe?

file version info and known copies

Original nameWLRMNDR.EXE in the file’s header: a renamed copy still carries it

Installed inC:\Windows\system32\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWindows logon reminder

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wlrmdr.exe · signed by Microsoft Windows

354b7b5f6d13bad37a062f3ce47d84a45efeda243813cd8bbcb8650d313e3ee4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wlrmdr.exe · signed by Microsoft Windows

2fda95aafb2e9284c730bf912b93f60a75b151941adc14445ed1e056140325b1

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wlrmdr.exe · signed by Microsoft Windows

876e04f2c6f953c80edf173dfb2eb950257aabe5603abc2ea43eac0229a553a3

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wlrmdr.exe · signed by Microsoft Windows

afd7a491842a8c8685d6b07a7ab915c3dcf9b6c157485c143ed0d0ec81c71c58

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wlrmdr.exe · signed by Microsoft Windows

4c13ccd996d58673bec9fa19b1f06b8ca1d6823307b76c5a2a79799f1073bf64

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\wlrmdr.exe · signed by Microsoft Windows

6a90bb51f5f54bf1cc66d95d078e119c74fbf6fceb69c1301d65e25f03e596f0

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\wlrmdr.exe · signed by Microsoft Windows

c27ccb3657d83e9e0cb329807c1ab66d02e49a90230ef711d8348562b6f2486d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.