workfolders.exe

Work Folders file version info (xCyclopedia)

LOLBAS Execute 2 Sigma rules name it 1 ATT&CK technique 2 documented commands 4 known copies with hashes

How workfolders.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for workfolders.exe.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution User privileges

Execute control.exe in the current working directory

WorkFolders

Identify

Execute T1218 System Binary Proxy Execution User privileges

WorkFolders attempts to execute control.exe. By modifying the default value of the App Paths registry key for control.exe in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\control.exe, an attacker can achieve proxy execution.

WorkFolders

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for workfolders.exe, by Elliot Killick, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for workfolders.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

T1218System Binary Proxy Execution

Is it the real workfolders.exe?

file version info and known copies

Installed inC:\Windows\system32\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWork Folders

4 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WorkFolders.exe · signed by Microsoft Windows

f4704f7172e0cb5f4c79775a91638f94d3220562a4dc8f660373f29d1ad0848c

10.0.19041.329 (WinBuild.160101.0800) · C:\Windows\system32\WorkFolders.exe · signed by Microsoft Windows

cfc058a712b0f1a0932e7fa1f17430eeaa231c41fdd1ead38639d603a8006aca

10.0.19041.1202 (WinBuild.160101.0800) · C:\Windows\system32\WorkFolders.exe · signed by Microsoft Windows

8eb0b45fde1883eba4cfe9545fb64a17243ebff32ed69fd39e9cb36febd54760

10.0.18362.778 (WinBuild.160101.0800) · C:\WINDOWS\system32\WorkFolders.exe · signed by Microsoft Windows

a4ed29118f6a9c15a16668161bcc872c4785d76f68144b57d2fe1011ec4764b6

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.