Execution of Remote.exe for AWL Bypass or Remote File Execution
This rule detects the execution of 'remote.exe', a legitimate utility part of WinDbg in the Windows SDK. Adversaries can abuse remote.exe for application whitelisting (AWL) bypass and to execute remote files, making it a living-off-the-land binary (LOLBin). The detection is based on the image path ending with '\remote.exe' or the original filename being 'remote.exe'.
Sigma
