LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Tracker.exe

View source

Tool included with Microsoft .Net Framework.

ExecuteAWL Bypass
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute1

EXAMPLE 01T1127

Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions.

COMMAND
Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exe
USE CASE
Injection of locally stored DLL file into target process.
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · DLL

AWL Bypass1

EXAMPLE 01T1127

Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions.

COMMAND
Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exe
USE CASE
Injection of locally stored DLL file into target process.
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · DLL
02 / ON DISK

Known paths

no default
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Casey Smith@subTee