Identifier / Programs / Windows
write.exe
Write a message on the terminal of a specified logged in user (<Ctrl c> to stop writing messages). Use the who command to find out all terminal_ids of all active users active on the system. tldr-pages
LOLBAS Execute 2 Sigma rules name it 1 ATT&CK technique 1 documented command 12 known copies with hashes
How write.exe is abused
Execute T1218 System Binary Proxy Execution
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for write.exe.
1 documented command
Execute T1218 System Binary Proxy Execution User privileges
Executes a binary provided in default value of HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\wordpad.exe.
write.exeThe command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for write.exe, by Michal Belzak, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for write.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real write.exe?
write in the file’s header: a renamed copy still carries itC:\Windows\system32\C:\Windows\SysWOW64\12 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\write.exe · signed by Microsoft Windows
3875dd026772c4b2169f3001c25a169e80161cd5c405c24d4ffa07b79d5fcd5710.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\write.exe · signed by Microsoft Windows
7dcaae3f0fe609727c7b64b011ae6c5c839f9881415046726e945d1e9d1b930010.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\write.exe · signed by Microsoft Windows
6f760002730a8ca55181eb61eb7d9764d91f236efc602168f225cb0cd918029510.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\write.exe · signed by Microsoft Windows
a70d52eda892edc073932b462cc367cdbfbace3f4196857d8d4fa869a13de79210.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\write.exe · signed by Microsoft Windows
cfbb731014e491b6fc70305d23195003cc0df802b8c9bcf4e586fd7c92900b1810.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\write.exe · signed by Microsoft Windows
ee25f7a64b299968be5109c6ab8d692cebe12ff7bbafebf53918787c602f104c10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\write.exe · signed by Microsoft Windows
0ffcc65f70860f3961694ba64dbe7d69b09b5f0d6eb095dff8349d6b2f1f0e9610.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\write.exe · signed by Microsoft Windows
664256fde0e3a7c39801d91dd20204250638048e0e3f12c5891a84ffe283680a10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\write.exe · signed by Microsoft Windows
7e3485f5edd48ffce37b0b0b735cd97f5ab514aa8dc4d6bc16cc4c40fb3fb57010.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\write.exe · signed by Microsoft Windows
ba242dbd6c86655291bbdc01afefb0a9c880265b837442ab4c210666ef07b9256.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\write.exe · not signed
5cbeea096c7a0ad76e40f461c1a2c1d79bab42c1730ed70ecd8183302f9be3576.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\write.exe · not signed
e559c2673d312a0089d8dcdfaecd7fe261f74aaaf02a110722b34a0c85574012From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
Send a message to a given user on a given terminal ID
write username terminal_idIdentifySend message to "testuser" on terminal /dev/tty5
write testuser tty5IdentifySend message to "johndoe" on pseudo terminal /dev/pts/5
write johndoe pts/5IdentifyNone of the 3 examples the identifier reads matches LOLBAS abuse or trips a Sigma process-creation rule.