Debugging tool included with Windows Debugging Tools
Remote.exe /s "powershell.exe" anythinghere
Spawns powershell as a child process of remote.exe
Executes a process under a trusted Microsoft signed binary
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\remote.exe, C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\remote.exe
IOC: remote.exe process spawns, Sigma: https://github.com/SigmaHQ/sigma/blob/197615345b927682ab7ad7fa3c5f5bb2ed911eed/rules/windows/process_creation/proc_creation_win_lolbin_remote.yml
mr.d0x (@mrd0x)