Debugging tool included with Windows Debugging Tools Located at: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\adplus.exe; C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\adplus.exe.
adplusadplusSandbox: execFile · Timeout: 30s
credential.dump security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Creates a memory dump of the lsass process (Create memory dump and parse it offline)
adplus.exe -hang -pn lsass.exe -o {PATH_ABSOLUTE:folder} -quietExecute arbitrary commands using adplus config file (see Resources section for a sample file). (Run commands under a trusted Microsoft signed binary)
adplus.exe -c {PATH:.xml}Dump process memory using adplus config file (see Resources section for a sample file). (Run commands under a trusted Microsoft signed binary)
adplus.exe -c {PATH:.xml}Execute arbitrary commands and binaries from the context of adplus. Note that providing an output directory via '-o' is required. (Run commands under a trusted Microsoft signed binary)
adplus.exe -crash -o "{PATH_ABSOLUTE:folder}" -sc {PATH:.exe}| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/6199a703221a98ae6ad343c79c558da375203e4e/rules/windows/process_creation/proc_creation_win_lolbin_adplus.yml |
| ioc | As a Windows SDK binary, execution on a system may be suspicious |
adplus is a Windows LOLBin. Debugging tool included with Windows Debugging Tools Located at: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\adplus.exe; C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\adplus.exe.