LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

adplus.exe

View source

Debugging tool included with Windows Debugging Tools

DumpExecute
04COMMAND EXAMPLES
02ATT&CK TECHNIQUES
01DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

4 examples

Dump2

EXAMPLE 01T1003.001

Creates a memory dump of the lsass process

COMMAND
adplus.exe -hang -pn lsass.exe -o {PATH_ABSOLUTE:folder} -quiet
USE CASE
Create memory dump and parse it offline
PRIVILEGES
SYSTEM
OPERATING SYSTEM
All Windows
EXAMPLE 02T1003.001

Dump process memory using adplus config file (see Resources section for a sample file).

COMMAND
adplus.exe -c {PATH:.xml}
USE CASE
Run commands under a trusted Microsoft signed binary
PRIVILEGES
SYSTEM
OPERATING SYSTEM
All Windows

Execute2

EXAMPLE 01T1127

Execute arbitrary commands using adplus config file (see Resources section for a sample file).

COMMAND
adplus.exe -c {PATH:.xml}
USE CASE
Run commands under a trusted Microsoft signed binary
PRIVILEGES
User
OPERATING SYSTEM
All Windows
Execute · CMD
EXAMPLE 02T1127

Execute arbitrary commands and binaries from the context of adplus. Note that providing an output directory via '-o' is required.

COMMAND
adplus.exe -crash -o "{PATH_ABSOLUTE:folder}" -sc {PATH:.exe}
USE CASE
Run commands under a trusted Microsoft signed binary
PRIVILEGES
User
OPERATING SYSTEM
All windows
Execute · CMDExecute · EXE
02 / ON DISK

Known paths

C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\adplus.exe
C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\adplus.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    As a Windows SDK binary, execution on a system may be suspicious

REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

mr.d0x@mrd0x
Nasreddine Bencherchali@nas_bench