LOL · OtherMSBinary

Tracker.exe

2 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions.

Use Injection of locally stored DLL file into target process.

Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exe

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1127
Detection: Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_tracker.yml
Refs: twitter.com/subTee/status/793151392185589760
attack.mitre.org/wiki/Execution
lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/

AWL Bypass

AWL / Policy BypassWindows

Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions.

Use Injection of locally stored DLL file into target process.

Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exe

Evidence: Upstream reference
Environment: Local host
Context: user
Native: AWL Bypass
MITRE: T1127
Detection: Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_tracker.yml
Refs: twitter.com/subTee/status/793151392185589760
attack.mitre.org/wiki/Execution
lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/