OfflineScannerShell.exe

Execute mpclient.dll library in the current working directory

Use Can be used to evade defensive countermeasures or to hide as a persistence mechanism

OfflineScannerShell

Evidence

Upstream reference

Environment

Local host

Context

admin

Native

Execute

MITRE

T1218

Detection

Sigma: github.com/SigmaHQ/sigma/blob/bea6f18d350d9c9fdc067f93dde0e9b11cc22dc2/rules/windows/process_creation/proc_creation_win_lolbas_offlinescannershell.yml

IOC: OfflineScannerShell.exe should not be run on a normal workstation

Refs

lolbas-project.github.io/lolbas/Binaries/OfflineScannerShell/