Identifier / Programs / Windows
adplus.exe
LOLBAS Dump, Execute 1 Sigma rule name it 2 ATT&CK techniques 4 documented commands 4 known copies with hashes
How adplus.exe is abused
Execute T1127 Trusted Developer Utilities Proxy Execution
-cDump T1003.001 OS Credential Dumping: LSASS Memory
-cEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for adplus.exe.
4 documented commands
Dump T1003.001 OS Credential Dumping: LSASS Memory SYSTEM privileges
Creates a memory dump of the lsass process
adplus.exe -hang -pn lsass.exe -o {PATH_ABSOLUTE:folder} -quietTrips 1 Sigma rule: highPotential Adplus.EXE Abuse by Nasreddine Bencherchali (Nextron Systems)
Execute T1127 Trusted Developer Utilities Proxy Execution User privileges
Execute arbitrary commands using adplus config file (see Resources section for a sample file).
adplus.exe -c {PATH:.xml}Trips 1 Sigma rule: highPotential Adplus.EXE Abuse by Nasreddine Bencherchali (Nextron Systems)
Dump T1003.001 OS Credential Dumping: LSASS Memory SYSTEM privileges
Dump process memory using adplus config file (see Resources section for a sample file).
adplus.exe -c {PATH:.xml}Trips 1 Sigma rule: highPotential Adplus.EXE Abuse by Nasreddine Bencherchali (Nextron Systems)
Execute T1127 Trusted Developer Utilities Proxy Execution User privileges
Execute arbitrary commands and binaries from the context of adplus. Note that providing an output directory via '-o' is required.
adplus.exe -crash -o "{PATH_ABSOLUTE:folder}" -sc {PATH:.exe}Trips 1 Sigma rule: highPotential Adplus.EXE Abuse by Nasreddine Bencherchali (Nextron Systems)
All 4 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for adplus.exe, by mr.d0x, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for adplus.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real adplus.exe?
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\4 known copies
10.0.19041.1 · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\adplus.exe · signed by Microsoft Corporation
6262054992658ca2dd8e5a8adb0b207b630baa75f930ae82a88835728db4b7c110.0.19041.1 · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\adplus.exe · signed by Microsoft Corporation
67d387d2c9c4d701958d28851664dc9e93a193ba29da0173db2891f4d1cf1d7a10.0.19041.1 · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\adplus.exe · signed by Microsoft Windows Kits Publisher
9daee0bde6608efe2a6e564ebdc716013ed79aefa65c8266597d5bb989fe683e10.0.19041.1 · C:\Program Files (x86)\Windows Kits\10\Debuggers\arm\adplus.exe · signed by Microsoft Windows Kits Publisher
ae72de3d3f8f22aa8af047a83baf0f2d5bc745fce882bfefec2597cce9d30d25From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.