Identifier / Programs / Windows
wsb.exe
LOLBAS Execute 1 ATT&CK technique 3 documented commands
How wsb.exe is abused
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for wsb.exe.
3 documented commands
Execute T1564.006 Hide Artifacts: Run Virtual Instance User privileges
Executes the given command in a Windows Sandbox from an inline XML configuration with an embedded <LogonCommand>, leaving no .wsb file on disk. Note: <LogonCommand> only fires once WDAGUtilityAccount actually logs in, which only happens after an RDP session is established via wsb connect, so this pattern opens a visible Sandbox window.
wsb start --config "<Configuration><LogonCommand><Command>{CMD}</Command></LogonCommand></Configuration>"
wsb exec -r System --id YOUR_IDExecute T1564.006 Hide Artifacts: Run Virtual Instance User privileges
Allows the specified folder to be accessible from within the Windows Sandbox, mounted under C:\users\WDAGUtilityAccount\Desktop with the same folder name as the source folder. This allows, for example, for copying payloads from the host system into the sandbox (seen here), copying payloads from the sandbox back to the host system, or for accessing arbitrary host system files by the sandbox.
wsb start --config "<Configuration><MappedFolders><MappedFolder><HostFolder>{PATH_ABSOLUTE:folder}</HostFolder><ReadOnly>false</ReadOnly></MappedFolder></MappedFolders></Configuration>"
wsb exec -r System --id YOUR_ID -c "cmd.exe /c copy C:\users\WDAGUtilityAccount\Desktop\Temp\{PATH} {PATH}"Execute T1564.006 Hide Artifacts: Run Virtual Instance User privileges
Allows the specified folder to be accessible from within the Windows Sandbox, mounted at c:\SOME_FOLDER. This allows, for example, for copying payloads from the host system into the sandbox, copying payloads from the sandbox back to the host system (seen here), or for accessing arbitrary host system files by the sandbox.
wsb start
wsb share --id YOUR_ID -f {PATH_ABSOLUTE:folder} -s c:\SOME_FOLDER --allow-write
wsb exec -r System --id YOUR_ID -c "cmd.exe /c copy {PATH_ABSOLUTE} c:\SOME_FOLDER"None of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for wsb.exe, by Konrad 'unrooted' Klawikowski, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for wsb.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.