Potential DLL Injection via Tracker.exe Command-Line on Windows

title: Potential DLL Injection via Tracker.exe Command-Line on Windows
id: 1bf97979-698d-40b9-ae47-3783253bc3d6
status: test
description: This rule flags process creation events where Tracker.exe is launched and its command line contains the switches associated with execution (/d and /c). The behavior is relevant because attackers may use Tracker.exe to load and execute additional code through DLL injection-like workflows. The detection relies on Windows process creation telemetry including Image and CommandLine fields, with exclusions for MSBuild-driven executions that match a known benign pattern.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_tracker.yml
author: Avneet Singh @v3t0_, oscd.community, Huntrule Team
date: 2020-10-18
modified: 2023-01-09
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \tracker.exe
    - Description: Tracker
  selection_cli:
    CommandLine|contains:
      - " /d "
      - " /c "
  filter_msbuild1:
    CommandLine|contains: " /ERRORREPORT:PROMPT "
  filter_msbuild2:
    ParentImage|endswith:
      - \Msbuild\Current\Bin\MSBuild.exe
      - \Msbuild\Current\Bin\amd64\MSBuild.exe
  condition: all of selection_* and not 1 of filter_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 148431ce-4b70-403d-8525-fcc2993f29ea
    type: derived