Ceplin Command Identifier

Identifier / Programs / Windows

offlinescannershell.exe

LOLBAS Execute 1 Sigma rule name it 1 ATT&CK technique 1 documented command

Opens the identifier with your command. It is read in your browser and sent nowhere.

How offlinescannershell.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for offlinescannershell.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution Administrator privileges

Execute mpclient.dll library in the current working directory

OfflineScannerShell
Identify

The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for offlinescannershell.exe, by Elliot Killick, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for offlinescannershell.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules
mediumPotential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Executionfrack113
T1218System Binary Proxy Execution

Other programs abused for Execute

acccheckconsole.exe · addinutil.exe · adplus.exe · advpack.dll · agentexecutor.exe · appcert.exe · applauncher.exe · appvlp.exe · at.exe · atbroker.exe · bash.exe · bginfo.exe · bitsadmin.exe · cdb.exe · certoc.exe · change.exe