{"id":"9cfc00b6-bfb7-49ce-9781-ef78503154bb","title":"Wlrmdr.EXE Uncommon Argument Or Child Process","description":"Detects the execution of \"Wlrmdr.exe\" with the \"-u\" command line flag which allows anything passed to it to be an argument of the ShellExecute API, which would allow an attacker to execute arbitrary binaries.\nThis detection also focuses on any uncommon child processes spawned from \"Wlrmdr.exe\" as a supplement for those that posses \"ParentImage\" telemetry.\n","author":"frack113, manasmbellani","status":"experimental","level":"medium","date":"2022-02-16","modified":"2025-10-31","tags":["attack.stealth","attack.t1218"],"technique_ids":["T1218"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://twitter.com/0gtweet/status/1493963591745220608?s=20&t=xUg9DsZhJy1q9bPTUWgeIQ","https://lolbas-project.github.io/lolbas/Binaries/Wlrmdr/"],"source_path":"rules/windows/process_creation/proc_creation_win_wlrmdr_uncommon_child_process.yml","source_sha256":"2e98e7f72822d932896808794a6875d144639c396104ddcc4ee11ce2153980a2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wlrmdr_uncommon_child_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Wlrmdr.EXE Uncommon Argument Or Child Process\nid: 9cfc00b6-bfb7-49ce-9781-ef78503154bb\nstatus: experimental\ndescription: |\n    Detects the execution of \"Wlrmdr.exe\" with the \"-u\" command line flag which allows anything passed to it to be an argument of the ShellExecute API, which would allow an attacker to execute arbitrary binaries.\n    This detection also focuses on any uncommon child processes spawned from \"Wlrmdr.exe\" as a supplement for those that posses \"ParentImage\" telemetry.\nreferences:\n    - https://twitter.com/0gtweet/status/1493963591745220608?s=20&t=xUg9DsZhJy1q9bPTUWgeIQ\n    - https://lolbas-project.github.io/lolbas/Binaries/Wlrmdr/\nauthor: frack113, manasmbellani\ndate: 2022-02-16\nmodified: 2025-10-31\ntags:\n    - attack.stealth\n    - attack.t1218\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent: # This selection is looking for processes spawned from wlrmdr using the \"-u\" flag\n        ParentImage|endswith: '\\wlrmdr.exe'\n    selection_child_img:\n        - Image|endswith: '\\wlrmdr.exe'\n        - OriginalFileName: 'WLRMNDR.EXE'\n    selection_child_cli_flags_s:\n        CommandLine|contains|windash: '-s '\n    selection_child_cli_flags_f:\n        CommandLine|contains|windash: '-f '\n    selection_child_cli_flags_t:\n        CommandLine|contains|windash: '-t '\n    selection_child_cli_flags_m:\n        CommandLine|contains|windash: '-m '\n    selection_child_cli_flags_a:\n        CommandLine|contains|windash: '-a '\n    selection_child_cli_flags_u:\n        CommandLine|contains|windash: '-u '\n    filter_main_winlogon:\n        ParentImage: 'C:\\Windows\\System32\\winlogon.exe'\n    filter_main_empty:\n        ParentImage:\n            - ''\n            - '-'\n    filter_main_null:\n        ParentImage: null\n    condition: selection_parent or (all of selection_child_* and not 1 of filter_main_*)\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/9cfc00b6-bfb7-49ce-9781-ef78503154bb.json","kind":"sigma"}