Tracker.exe

Commands

1. ExecuteUser T1127

   Injection of locally stored DLL file into target process.

   Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exe

   Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions.

   os: Windows

   Execute: DLL

2. AWL BypassUser T1127

   Injection of locally stored DLL file into target process.

   Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exe

   Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions.

   os: Windows

   Execute: DLL

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_tracker.yml

Resources

• https://twitter.com/subTee/status/793151392185589760
• https://attack.mitre.org/wiki/Execution