.. /Wlrmdr.exe
Star

Execute

Windows Logon Reminder executable

Paths:

Resources:

Acknowledgements:

Detections:

Execute

  1. Execute calc.exe with wlrmdr.exe as parent process

    wlrmdr.exe -s 3600 -f 0 -t _ -m _ -a 11 -u calc.exe
    Use case
    Use wlrmdr as a proxy binary to evade defensive countermeasures
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1202