LOL · OtherMSBinary

Logger.exe

3 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Executes the command specified after the `RUN` parameter as a child of `logger.exe`.

Use Executes an abitrary command via a signed binary to evade detection.

logger.exe RUN "{CMD}"

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1202
Refs: learn.microsoft.com/en-us/windows-hardware/drivers/debugger/logger
lolbas-project.github.io/lolbas/OtherMSBinaries/Logger/

ExecutionWindows

Executes the command specified after the `RUNW` parameter as a child of `logger.exe`.

Use Executes an abitrary command via a signed binary to evade detection.

logger.exe RUNW "{CMD}"

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1202
Refs: learn.microsoft.com/en-us/windows-hardware/drivers/debugger/logger
lolbas-project.github.io/lolbas/OtherMSBinaries/Logger/

ExecutionWindows

Executes the command specified as a child of `logger.exe`.

Use Executes an abitrary command via a signed binary to evade detection.

logger.exe "{CMD}"

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1202
Refs: learn.microsoft.com/en-us/windows-hardware/drivers/debugger/logger
lolbas-project.github.io/lolbas/OtherMSBinaries/Logger/