RemComSvc.exe

Top Paths

• C:\Windows\SysWOW64100%

Top Hashes (SHA256)

• 05d433ed3633a2e3ed1125c3cd629f18beb92f484c21c1b767290a368b98bdc0100%

Top Parents

• services.exe100%

Top Children

• cmd.exe100%

What does RemComSvc.exe normally do?

Not expected in most environments. RemCom is an open-source tool — legitimate use is limited to IT administration in environments that specifically deploy it. The service binary is pushed to the target machine's ADMIN$ share and executed via SCM.

When is RemComSvc.exe suspicious?

Any presence of remcomsvc.exe. Service creation for RemComSvc. File creation in C:\Windows\ or ADMIN$ share. Network connections on named pipes.

How do attackers abuse RemComSvc.exe?

LATERAL MOVEMENT: RemCom works identically to PsExec — the attacker runs remcom.exe on their machine, which copies remcomsvc.exe to the target's ADMIN$ share, creates and starts a service, and establishes interactive command execution over named pipes. Unlike PsExec, RemCom is open-source and unsigned, so it may evade detections specifically targeting Sysinternals binaries. Used by red teams and threat actors as a PsExec alternative when the Sysinternals version is detected/blocked.

Detection guidance

HIGH-CONFIDENCE DETECTIONS: - remcomsvc.exe file creation anywhere on the system - Service creation for "RemComSvc" or similar - remcomsvc.exe process execution DATA SOURCES: File creation (Sysmon 11), service installation (System Event 7045), process creation (Sysmon 1)

False positive notes

Very few legitimate uses. Some IT shops may use RemCom as a free PsExec alternative, but this is uncommon in enterprise environments.

MITRE ATT&CK techniques

References

• https://attack.mitre.org/techniques/T1021/002/