Windows Process Execution and DLL Injection via Tracker.exe
Alerts on Tracker.exe executions with /d and /c command-line switches, excluding matching MSBuild child process patterns.
- Product
- windows
- Category
- process_creation
- Author
- Avneet Singh @v3t0_, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-18
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the executable ends with "\tracker.exe" and the command line includes both " /d " and " /c ", matching patterns consistent with Tracker.exe being used for execution or DLL-related activity. It suppresses events that include " /ERRORREPORT:PROMPT " to reduce noise from legitimate build tooling scenarios. Telemetry required is process creation data including Image and CommandLine (and, implicitly, the ability to apply the exclusion filters).
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Execution and DLL Injection via Tracker.exe
id: 1bf97979-698d-40b9-ae47-3783253bc3d6
status: test
description: This rule flags Windows process creation events where the executable ends with "\tracker.exe" and the command line includes both " /d " and " /c ", matching patterns consistent with Tracker.exe being used for execution or DLL-related activity. It suppresses events that include " /ERRORREPORT:PROMPT " to reduce noise from legitimate build tooling scenarios. Telemetry required is process creation data including Image and CommandLine (and, implicitly, the ability to apply the exclusion filters).
references:
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_tracker.yml
author: Avneet Singh @v3t0_, oscd.community, Huntrule Team
date: 2020-10-18
modified: 2023-01-09
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1055.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \tracker.exe
- Description: Tracker
selection_cli:
CommandLine|contains:
- " /d "
- " /c "
filter_msbuild1:
CommandLine|contains: " /ERRORREPORT:PROMPT "
filter_msbuild2:
ParentImage|endswith:
- \Msbuild\Current\Bin\MSBuild.exe
- \Msbuild\Current\Bin\amd64\MSBuild.exe
condition: all of selection_* and not 1 of filter_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 148431ce-4b70-403d-8525-fcc2993f29ea
type: derived