.. /Reset.exe

Star

Paths:

• c:\windows\system32\reset.exe
• c:\windows\syswow64\reset.exe

Acknowledgements:

• Matan Bahar (@Bl4ckShad3)

Detections:

• IOC: reset.exe being executed and executes rwinsta.exe outside of its normal path of c:\windows\system32\ or c:\windows\syswow64\

Execute

1. Once executed, reset.exe will execute rwinsta.exe in the same folder. Thus, if reset.exe is copied to a folder and an arbitrary executable is renamed to rwinsta.exe, reset.exe will spawn it.

   reset.exe session

   Use case

   Execute an arbitrary executable via trusted system executable.

   Privileges required

   User

   Operating systems

   Windows 10, Windows 11

   ATT&CK® technique

   T1218

   Tags

   Execute: EXE

   Requires: Rename