Reset.exe

Remote Desktop Services Reset Utility

Execute

Execute an arbitrary executable via trusted system executable.

reset.exe session

Once executed, `reset.exe` will execute `rwinsta.exe` in the same folder. Thus, if `reset.exe` is copied to a folder and an arbitrary executable is renamed to `rwinsta.exe`, `reset.exe` will spawn it. — MITRE: T1218 — Privileges: User