LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

OfflineScannerShell.exe

View source

Windows Defender Offline Shell

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Execute mpclient.dll library in the current working directory

COMMAND
OfflineScannerShell
USE CASE
Can be used to evade defensive countermeasures or to hide as a persistence mechanism
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows 10, Windows 11
Execute · DLL
02 / ON DISK

Known paths

C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    OfflineScannerShell.exe should not be run on a normal workstation

COMMUNITY RESEARCH

Acknowledgements

Elliot Killick@elliotkillick