Abused Built-In and Admin Tools

How Malware Hides in a Process

Windows and admin suites ship tools that run, load or fetch code by design, such as rundll32.exe, regsvr32.exe and PsExec. They are genuine, signed and where Windows or their vendor installs them, so name, signature and path checks pass them. Used in an intrusion, they run code from a user or temporary folder or a URL. They can also start under an Office app, a script host or a remote admin service, or start a shell themselves. Read the full command line and the parent first, because what the tool was told to do, and by whom, decides whether it is doing its own job.

What It Is

Before, a built-in tool runs from its home folder, started by what normally starts it, with the arguments its own job needs. After, the same signed file runs with a command line, a parent, a folder or a network reach its job never needs.

The file is unchanged, so signature and path checks pass it. Event 4688 in the Security log, Sysmon event 1 and DeviceProcessEvents record its command line and parent. MITRE ATT&CK's detection for T1218 adds Sysmon events 3, 22 and 7, for what it reaches and loads.

What Changes Inside the Process

The process is shown before and after, and the pointer marks what changed.

Before

A clean Windows 11 install

The WMI provider host on a clean install, started by a service host and with no shell under it.
NameParentPath
svchost.exeservices.exeC:\Windows\System32\svchost.exe
WmiPrvSE.exesvchost.exeC:\Windows\System32\wbem\WmiPrvSE.exe
See It in the Window

After

ws-042,

PsExec's service on ws-042 at 09:58 on 12 Oct 2026, and the SYSTEM prompt it started a second later.
NameParentPath
services.exewininit.exeC:\Windows\System32\services.exe
PSEXESVC.exeservices.exeC:\Windows\PSEXESVC.exe
cmd.exePSEXESVC.exeC:\Windows\System32\cmd.exe
ParentStarted by PsExec's Service: A Prompt a Person Opens Starts Under explorer.exe or Their Terminal Abused Built-In and Admin Tools
See It in the Window

Look Inside

What It Leaves Behind

The binary is genuine and signed, but its command line loads or fetches code. It names a DLL or script from a user or temporary folder or from a URL, or has no arguments where it needs some. What it loads (Sysmon event 7), what it reaches (Sysmon events 3 and 22) and the children it starts complete the picture. A remote admin tool also leaves its service, such as PSEXESVC.exe under services.exe, with its install in System event 7045 and its named pipe in Sysmon event 17.

Why It Matters

A built-in tool passes signature and path checks, so only how, where and by whom it runs gives it away. Judge its command line, its parent and what it loads or reaches, never its name.

Which Evidence Can See It

Each tile says whether that kind of evidence can see it, and what it shows.

  • Memory

    Partly

    Only a tool still running at capture shows its command line and parent, in windows.cmdline and windows.pstree.

  • EDR Telemetry

    Sees it

    DeviceProcessEvents in Defender XDR records each start with its command line, its parent and its original file name.

  • Disk

    Partly

    The tool's own file is genuine, so it shows nothing. A DLL or script it ran from a user or temporary folder may remain.

  • Logs

    Partly

    Event 4688 in the Security log holds the command line once Audit Process Creation and its command line setting are on. Sysmon event 1 holds it where Sysmon runs.

How to Confirm It

Work through these in order. Each step names the page that shows how.

  1. Read the full command line from the creation record (4688 with command line auditing, Sysmon event 1 or DeviceProcessEvents). It shows what the tool loads or fetches, from where, and whether arguments are missing.Command Line and Environment
  2. Read its parent and its children. A built-in tool started by an Office app, a script host, WmiPrvSE.exe or a remote admin service, or one that starts a shell, needs a reason.Process Trees and Call Chains
  3. Check what it reached. A connection from rundll32.exe or regsvr32.exe to a public address is a published detection, and so is either one making a connection with no command line.Network Connections
  4. List what rundll32.exe or regsvr32.exe loaded. An unsigned DLL from a user or temporary folder is the code it was used to run.Loaded DLLs
  5. For PSEXESVC.exe, list its handles. Handle or Process Explorer live, or windows.handles in memory, shows PsExec's default pipe, \PSEXESVC. Then read System event 7045 for the service install and, where Sysmon runs, event 17 for the pipe, and find the account and machine that drove it.Handles, Pipes and Mutexes

Investigation Steps With Named Tools

Each question has the tools that answer it on a running machine, and in a memory image, a copy of its memory saved to a file.

  • What was it told to do, and by whom?

    On a Running Machine

    • DeviceProcessEvents (documentation, opens in a new tab)Logs and Records A Defender XDR table. It holds the records Defender for Endpoint keeps of what happened on each machine, and you search it with KQL. Each start's command line and parent, with its original file name, which gives away a renamed copy.

    In a Memory Image

  • Is it still running, and what does it reach?

    On a Running Machine

    • Defender for Endpoint live response (documentation, opens in a new tab)Live Machine Part of Defender for Endpoint. It opens a command console on one machine from the Defender portal, so you can list its processes from your desk. processes Its processes and connections commands list what runs now and every active connection.
    • Windows.Detection.LOLBins (documentation, opens in a new tab)Live Machine A Velociraptor artifact. It is a ready-made question Velociraptor asks of running machines, named from general to specific. LOLBins means living off the land binaries, built-in programs attackers reuse. An exchange artifact that flags running built-in tools whose command lines match LOLBAS patterns.

    In a Memory Image

What Defenders See

Each record names its log and what must be switched on to get it.

Record and Where It LandsWhat to ReadHow to Turn It On
4688 A new process has been created (opens in a new tab)SecurityIt is written on the computer the process ran on.New Process Name, Process Command Line and Creator Process Name show the tool, what it was told to load or fetch, and what started it.Process Trees and Call Chains shows how to read it.Turn on Audit Process Creation. For the command line, also turn on Include command line in process creation events.
1 Process creation (opens in a new tab)Microsoft-Windows-Sysmon/OperationalIt is written on any Windows computer running Sysmon.Image, CommandLine and ParentImage show a built-in tool started by an Office app, a script host or a service, with a DLL or a URL in its arguments.Process Trees and Call Chains shows how to read it.Run Sysmon with ProcessCreate events in its configuration.
DeviceProcessEvents (opens in a new tab)Each row is a process creation or a related event, naming the new process, the process that created it and that creator's parent.Defender XDR, advanced huntingFileName, ProcessCommandLine and InitiatingProcessFileName, with ProcessVersionInfoOriginalFileName for a tool copied under another name.The Defender for Endpoint sensor on the device
3 Network connection (opens in a new tab)Microsoft-Windows-Sysmon/OperationalIt is written on any Windows computer running Sysmon.rundll32.exe or regsvr32.exe making a connection, above all to a public address.Network Connections shows how to read it.Run Sysmon with NetworkConnect events in its configuration. They are off by default.
7 Image loaded (opens in a new tab)Microsoft-Windows-Sysmon/OperationalIt is written on any Windows computer running Sysmon.An unsigned DLL from a user or temporary folder loaded into rundll32.exe or regsvr32.exe.Loaded DLLs shows how to read it.Run Sysmon with ImageLoad events in its configuration. They are off by default.
7045 New Service Installed (opens in a new tab)SystemThe Service Control Manager writes it on the computer the service was installed on.A new service whose binary is PSEXESVC.exe, or a renamed copy, on a machine nobody administers that way.On by default
AsrPsexecWmiChildProcessAudited, AsrPsexecWmiChildProcessBlocked (opens in a new tab)The attack surface reduction (ASR) rule against processes created through PsExec and WMI fired, in audit or block mode.DeviceEventsDefender XDR, advanced huntingThe ASR rule stopping, or auditing, a process created through PsExec or WMI.The Defender for Endpoint sensor on the device

What It Looks Like

This record is decoded field by field, with what each value means.

4688 A new process has been created (opens in a new tab)On ws-042, . Event 4688 in the Security log for PSEXESVC.exe on ws-042 at 09:58:13 on 12 Oct 2026, field by field.
Field, as the Record Writes ItWhat It Tells You
New Process NameC:\Windows\PSEXESVC.exePsExec's service binary, in the Windows folder, where PsExec puts it. Its start means someone ran PsExec against this machine.
Creator Process NameC:\Windows\System32\services.exeStarted by the Service Control Manager, so it ran as a service. System event 7045 records its install in the same second.
Creator Subject: Account NameWS-042$The computer account, which is how SYSTEM shows in this field. The service ran as SYSTEM, whoever asked for it.
Target Subject: Account Name-Empty, because the new process shares its creator's logon. Its account is then the Creator Subject's: SYSTEM.
Token Elevation TypeTokenElevationTypeDefault (1)Default (Type 1), the type services and SYSTEM run with, never split by User Account Control. Nothing here passed through an elevation.
Mandatory LabelS-1-16-16384System integrity, the level of services that run as SYSTEM. A remote tool's service runs with full control of the machine.
False Positives

Software deployment uses the same tools, and Velociraptor's LOLBins artifact warns that msiexec.exe installing from a URL is also normal deployment. Compare hits with what your administrators and tools run, from where and when.

Microsoft notes that the Configuration Manager client relies heavily on WMI. So on machines it manages, processes started through WMI and the PsExec and WMI ASR rule's audit events can be its own work.

Blind Spots

A copy of a tool under another name passes a name match, so hunt on the original file name from version information too.

Live listings, the LOLBins artifact and windows.cmdline see only tools still running. For one that ran and exited, read its command line from creation records.

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

Sees It DirectlyDeviceProcessEvents (documentation, opens in a new tab)

Needs Defender for Endpoint. Administrators use PsExec and management agents use WMI, so a hit is not misuse on its own. Compare it with what your teams run. An Office app starting any of these is rarer.

KQLDefender XDR, Advanced hunting
// Built-in tools, renamed copies included, started by Office apps, script hosts, WMI or a remote admin servicelet Tools = dynamic(["rundll32.exe", "regsvr32.exe", "mshta.exe", "msbuild.exe", "certutil.exe", "bitsadmin.exe", "cmd.exe", "powershell.exe"]);let Parents = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "wscript.exe", "cscript.exe", "mshta.exe", "wmiprvse.exe", "psexesvc.exe"]);DeviceProcessEvents| where Timestamp > ago(30d)| where FileName in~ (Tools) or ProcessVersionInfoOriginalFileName in~ (Tools)| where InitiatingProcessFileName in~ (Parents) or InitiatingProcessVersionInfoOriginalFileName in~ (Parents)| summarize Starts = count(), Devices = dcount(DeviceId), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)    by InitiatingProcessFileName, FileName, ProcessVersionInfoOriginalFileName, ProcessCommandLine| order by Devices asc, Starts asc

In a Memory Image

Volatility 3 reads a memory image, and each of its plugins below shows part of this sign.

  • windows.cmdline (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. cmdline means command line. The command line of each tool still running at capture, showing what it was told to load or fetch.
  • windows.pstree (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. pstree means process tree. Who started it, by recorded parent PID, such as a shell under PSEXESVC.exe, which sits under services.exe.
  • windows.dlllist (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. dlllist means DLL list. The DLLs rundll32.exe or regsvr32.exe loaded, with their paths. One from a user or temporary folder is the code it ran.
  • windows.svcscan (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. svcscan means service scan. Service records in memory with each binary, PSEXESVC among them while it is installed.
  • windows.netscan (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. netscan means network scan. Connections owned by a built-in tool such as rundll32.exe.

Rules to Compare With

Security vendors publish detection rules anyone can read. These look for the same thing, so compare your own with them.

Show the 8 Public Rules

How to Prevent It

Each control helps prevent it, and its line says what it does here.

Related

Where It Matters Most
  • services.exe A child named PSEXESVC.exe, the default name of PsExec's service binary.
Travels with

Sources

MITRE ATT&CK is a free public catalogue of the techniques attackers use. Each technique has an ID, such as T1055 for Process Injection, so defenders can name the same behaviour the same way. This page covers these techniques.