tracker.exe

Tracker file version info (xCyclopedia)

LOLBAS Execute, AWL Bypass 1 Sigma rule name it 2 ATT&CK techniques 2 documented commands 2 known copies with hashes

How tracker.exe is abused

documented by LOLBAS

Execute T1127 Trusted Developer Utilities Proxy Execution

-d

-c

AWL Bypass T1127 Trusted Developer Utilities Proxy Execution

-d

-c

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for tracker.exe.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1127 Trusted Developer Utilities Proxy Execution User privileges

Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions.

Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exe

Identify

AWL Bypass T1127 Trusted Developer Utilities Proxy Execution User privileges

Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions.

Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exe

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for tracker.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for tracker.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumPotential DLL Injection Or Execution Using Tracker.exeAvneet Singh @v3t0_, oscd.community

T1055.001Process Injection: Dynamic-link Library Injection

T1127Trusted Developer Utilities Proxy Execution

Is it the real tracker.exe?

file version info and known copies

Installed inC:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\

Signed byMicrosoft Corporation

ProductMicrosoft .NET Framework, Microsoft Corporation

DescriptionTracker

2 known copies

14.8.4084.0 built by: NET48REL1 · C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\Tracker.exe · signed by Microsoft Corporation

5b97761c5c93fc7205eeed95bda09cc48bd5511e3ece91f107dc175b89be8975

14.8.4084.0 built by: NET48REL1 · C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\Tracker.exe · signed by Microsoft Corporation

63bb4ecf8c913b79473cc9afb38fd77b63fbfde3750ec1e937315631fb6e0d80

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.