Identifier / Programs / Windows
logger.exe
Add messages to syslog. tldr-pages
LOLBAS Execute 1 ATT&CK technique 3 documented commands 2 known copies with hashes
How logger.exe is abused
Execute T1202 Indirect Command Execution
run
Execute T1202 Indirect Command Execution
runw
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for logger.exe.
3 documented commands
Execute T1202 Indirect Command Execution User privileges
Executes the command specified after the RUN parameter as a child of logger.exe.
logger.exe RUN "{CMD}"Execute T1202 Indirect Command Execution User privileges
Executes the command specified after the RUNW parameter as a child of logger.exe.
logger.exe RUNW "{CMD}"Execute T1202 Indirect Command Execution User privileges
Executes the command specified as a child of logger.exe.
logger.exe "{CMD}"None of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for logger.exe, by Avihay Eldad, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for logger.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real logger.exe?
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\2 known copies
Version not recorded · C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\logger.exe · signed by Microsoft Corporation
388767f42ae5fcf196c152c351df814ce14a85b4af1ea63adb10622de0ff989cVersion not recorded · C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\logger.exe · signed by Microsoft Corporation
e5aa8d65747efd4862e74fd223566e3b9d044b0c2d662bd23b53a93d12237d3aFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
Log a message to syslog
logger messageIdentifyThe example the identifier reads matches no LOLBAS abuse and trips no Sigma process-creation rule.