Windows Process Execution and DLL Injection via Tracker.exe

Alerts on Tracker.exe executions with /d and /c command-line switches, excluding matching MSBuild child process patterns.

FreeReviewedSigma · Medium · v2
Product
windows
Category
process_creation
Author
Avneet Singh @v3t0_, oscd.community (SigmaHQ), DRL 1.1
Published
2020-10-18
Updated
2026-07-31

ATT&CK techniques

Priv Esc → Defense Evasion
  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Cred Access

  7. Discovery

  8. Lateral Movement

  9. Collection

  10. C2

  11. Exfiltration

  12. Impact

What it detects

This rule flags Windows process creation events where the executable ends with "\tracker.exe" and the command line includes both " /d " and " /c ", matching patterns consistent with Tracker.exe being used for execution or DLL-related activity. It suppresses events that include " /ERRORREPORT:PROMPT " to reduce noise from legitimate build tooling scenarios. Telemetry required is process creation data including Image and CommandLine (and, implicitly, the ability to apply the exclusion filters).

Related detections9 linkedT1055.001 — drag to rearrange
Suspicious Process Injection via mavinject INJECTRUNNING
In-Memory Process Injection via Mavinject INJECTRUNNING (via process_creation)
Suspicious Service Reconfiguration of SessionEnv or IKEEXT for DLL Injection by EAGERBEE
Windows Process Creation: Renamed Mavinject32/64.EXE Execution
Windows Process Injection via Mavinject Using INJECTRUNNING Flag
Windows TAIDOOR RAT DLL Load via rundll32 Command Line
Windows renamed dctask64.exe execution via known IMPHASH values
Windows Process Creation: Detect dctask64.exe with Endpoint Central Execution/Injection Flags
Windows CreateRemoteThread with LoadLibraryA likely DLL injection
Windows Process Execution and DLL Injection via Tracker.exe
Pivot detection · T1055.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.