LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Dxcap.exe

View source

DirectX diagnostics/debugger included with Visual Studio.

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1127

Launch specified executable as a subprocess of dxcap.exe. Note that you should have write permissions in the current working directory for the command to succeed; alternatively, add '-file c:\path\to\writable\location.ext' as first argument.

COMMAND
Dxcap.exe -c {PATH_ABSOLUTE:.exe}
USE CASE
Local execution of a process as a subprocess of dxcap.exe
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · EXE
EXAMPLE 02T1127

Once executed, `dxcap.exe` will execute `xperf.exe` in the same folder. Thus, if `dxcap.exe` is copied to a folder and an arbitrary executable is renamed to `xperf.exe`, `dxcap.exe` will spawn it.

COMMAND
dxcap.exe -usage
USE CASE
Execute an arbitrary executable via trusted system executable.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · EXERequires · Rename
02 / ON DISK

Known paths

C:\Windows\System32\dxcap.exe
C:\Windows\SysWOW64\dxcap.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    dxcap.exe executing from outside of System32/SysWOW64

  • IOC

    dxcap.exe spawning Xperf.exe

  • IOC

    Xperf.exe executing from unusual directories (if not running from ADK path)

REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Matt harr0ey@harr0ey
Vikas Singh@vikas891
Naor Evgi@ghosts621