Identifier / Programs / Windows
dxcap.exe
LOLBAS Execute 1 Sigma rule name it 2 ATT&CK techniques 2 documented commands
How dxcap.exe is abused
Execute T1127 Trusted Developer Utilities Proxy Execution
-cExecute T1127 Trusted Developer Utilities Proxy Execution
-usageEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for dxcap.exe.
2 documented commands
Execute T1127 Trusted Developer Utilities Proxy Execution User privileges
Launch specified executable as a subprocess of dxcap.exe. Note that you should have write permissions in the current working directory for the command to succeed; alternatively, add '-file c:\path\to\writable\location.ext' as first argument.
Dxcap.exe -c {PATH_ABSOLUTE:.exe}Trips 1 Sigma rule: mediumNew Capture Session Launched Via DXCap.EXE by Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Execute T1127 Trusted Developer Utilities Proxy Execution User privileges
Once executed, dxcap.exe will execute xperf.exe in the same folder. Thus, if dxcap.exe is copied to a folder and an arbitrary executable is renamed to xperf.exe, dxcap.exe will spawn it.
dxcap.exe -usageTrips no Sigma process-creation rule.
1 of the 2 commands the identifier reads trips a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for dxcap.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for dxcap.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.