Ntsd.exe

type: OtherMSBinaries

Symbolic Debugger for Windows.

Full path

C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\ntsd.exe
C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\ntsd.exe
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\ntsd.exe
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\ntsd.exe

Commands

ExecuteUser T1127
Executes an executable under a trusted microsoft signed binary.
```
ntsd.exe -g {CMD}
```
Launches command through the debugging process; optionally add -G to exit the debugger automatically.
os: Windows
Execute: CMD

Resources

acknowledgement: Avihay Eldad @AvihayEldad