2018-06-09 00:15:06 +02:00
---
Name : Tracker.exe
2018-09-22 04:58:00 +02:00
Description : Tool included with Microsoft .Net Framework.
Author : 'Oddvar Moe'
2018-06-09 00:15:06 +02:00
Created : '2018-05-25'
Commands :
- Command : Tracker.exe /d .\calc.dll /c C:\Windows\write.exe
Description : Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions.
2018-09-22 04:58:00 +02:00
Usecase : Injection of locally stored DLL file into target process.
Category : AWL Bypass
Privileges : User
MitreID : T1218
MitreLink : https://attack.mitre.org/wiki/Technique/T1218
OperatingSystem : Windows
2018-06-09 00:15:06 +02:00
Full Path : ''
Code Sample : [ ]
Detection : [ ]
Resources :
- https://twitter.com/subTee/status/793151392185589760
- https://attack.mitre.org/wiki/Execution
2018-09-22 04:58:00 +02:00
Acknowledgment :
- Person : Casey Smith
Handle : '@subTee'
