Ceplin Command Identifier

Identifier / Programs / Windows

esentutl.exe

Extensible Storage Engine Utilities for Microsoft(R) Windows(R) file version info (xCyclopedia)

LOLBAS Copy, ADS, Download 3 Sigma rules name it 4 ATT&CK techniques 6 documented commands 12 known copies with hashes

Opens the identifier with your command. It is read in your browser and sent nowhere.

How esentutl.exe is abused

documented by LOLBAS

Copy T1105 Ingress Tool Transfer

-y
-d
-o

ADS T1564.004 Hide Artifacts: NTFS File Attributes

-y
-d
-o

Download T1564.004 Hide Artifacts: NTFS File Attributes

-y
-d
-o

Copy T1003.003 OS Credential Dumping: NTDS

-y
-vss
-d

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for esentutl.exe.

6 documented commands

from LOLBAS, each read by the identifier

Copy T1105 Ingress Tool Transfer User privileges

Copies the source VBS file to the destination VBS file.

esentutl.exe /y {PATH_ABSOLUTE:.source.vbs} /d {PATH_ABSOLUTE:.dest.vbs} /o
Identify

Trips 1 Sigma rule: highCopying Sensitive Files with Credential Data by Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Copies the source EXE to an Alternate Data Stream (ADS) of the destination file.

esentutl.exe /y {PATH_ABSOLUTE:.exe} /d {PATH_ABSOLUTE}:file.exe /o
Identify

Trips 1 Sigma rule: highCopying Sensitive Files with Credential Data by Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Copies the source Alternate Data Stream (ADS) to the destination EXE.

esentutl.exe /y {PATH_ABSOLUTE}:file.exe /d {PATH_ABSOLUTE:.exe} /o
Identify

Trips 1 Sigma rule: highCopying Sensitive Files with Credential Data by Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Copies the remote source EXE to the destination Alternate Data Stream (ADS) of the destination file.

esentutl.exe /y {PATH_SMB:.exe} /d {PATH_ABSOLUTE}:file.exe /o
Identify

Trips 1 Sigma rule: highCopying Sensitive Files with Credential Data by Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community

Download T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Copies the source EXE to the destination EXE file

esentutl.exe /y {PATH_SMB:.source.exe} /d {PATH_SMB:.dest.exe} /o
Identify

Trips 1 Sigma rule: highCopying Sensitive Files with Credential Data by Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community

Copy T1003.003 OS Credential Dumping: NTDS Admin privileges

Copies a (locked) file using Volume Shadow Copy

esentutl.exe /y /vss c:\windows\ntds\ntds.dit /d {PATH_ABSOLUTE:.dit}
Identify

Trips 1 Sigma rule: highCopying Sensitive Files with Credential Data by Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community

All 6 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for esentutl.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for esentutl.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules
mediumEsentutl Steals Browser Informationfrack113
highCopying Sensitive Files with Credential DataTeymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
mediumPotential Browser Data StealingNasreddine Bencherchali (Nextron Systems)
T1003.003OS Credential Dumping: NTDS
T1005Data from Local System
T1105Ingress Tool Transfer
T1564.004Hide Artifacts: NTFS File Attributes

Is it the real esentutl.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionExtensible Storage Engine Utilities for Microsoft(R) Windows(R)

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\esentutl.exe · signed by Microsoft Windows

0493bf2fadc61916eaed886b8439169bc5bf522e77b9f2e11d6cf065fbf4d536

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\esentutl.exe · signed by Microsoft Windows

954aaa329e4225e0a83f36f96daa5b7b418bd6207f8df7231ba8ce75e5996cd9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\esentutl.exe · signed by Microsoft Windows

26d0a05d6ac8584440b3b771cf8be4746e5f2bf19ffb118fd7c7dd551f61ba74

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\esentutl.exe · signed by Microsoft Windows

753feb8e2bc07b6ed0e3ba836a33ec3c6f097a237fb9d48c23938892c8a16f4a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\esentutl.exe · signed by Microsoft Windows

8a0bf768502c8006ceac62e3f1564e6893595170a4601e89b0f67c574ec98c41

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\esentutl.exe · signed by Microsoft Windows

a2e7adbfa82100773d6e3aa992d8652f9e23f133bb6d18680b81edb17af3f5e8

10.0.17763.529 (WinBuild.160101.0800) · C:\Windows\SysWOW64\esentutl.exe · signed by Microsoft Windows

1423e39922cf30ed6a9d0eb9ba463e6723fe166641dab9f3b27e4a8d30addcb5

10.0.17763.529 (WinBuild.160101.0800) · C:\Windows\system32\esentutl.exe · signed by Microsoft Windows

a3ee005c46f1dea44f2affd99c3bd1545b7d5448cb54cf774841cf93da5a7208

10.0.14393.2999 (rs1_release_inmarket.190520-1518) · C:\Windows\SysWOW64\esentutl.exe · signed by Microsoft Windows

055c27cfc7d045461ae3968178e886cf02bdb518599aac5908c254e2e92704dc

10.0.14393.2999 (rs1_release_inmarket.190520-1518) · C:\Windows\system32\esentutl.exe · signed by Microsoft Windows

6363fbbdb2e8aa68e11d12cf20ee008a86517d93ba155b1a32b5dc9a7af61876

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\esentutl.exe · not signed

3dfa41f89abfeb121bf98d70a94c4c7f01960e8d48195ae82c7045dab46f7366

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\esentutl.exe · not signed

f57af39536cff183d5ccb4940da32447e25538f17776e68a323bc32309ef267c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Other programs abused for Copy

bitsadmin.exe · colorcpl.exe · dtutil.exe · expand.exe · extrac32.exe · msdeploy.exe · print.exe · replace.exe · tar.exe · wmic.exe