.. /
Wlrmdr.exe
Windows Logon Reminder executable
Paths:
- c:\windows\system32\wlrmdr.exe
Resources:
Execute
Execute calc.exe with wlrmdr.exe as parent process
wlrmdr.exe -s 3600 -f 0 -t _ -m _ -a 11 -u calc.exe
Usecase: Use wlrmdr as a proxy binary to evade defensive countermeasures
Privileges required: User
OS: Windows 10, Windows 11
MITRE ATT&CK®: T1202