LOL · OtherMSBinary

Tracker.exe

2 techniques WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions.

Use Injection of locally stored DLL file into target process.

Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exe

Context: user
Native: Execute
MITRE: T1127
Detection: Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_tracker.yml
Refs: twitter.com/subTee/status/793151392185589760
attack.mitre.org/wiki/Execution
lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/

AWL Bypass

AWL / Policy Bypass Windows

Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions.

Use Injection of locally stored DLL file into target process.

Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exe

Context: user
Native: AWL Bypass
MITRE: T1127
Detection: Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_tracker.yml
Refs: twitter.com/subTee/status/793151392185589760
attack.mitre.org/wiki/Execution
lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/