DirectX diagnostics/debugger included with Visual Studio. Located at: C:\Windows\System32\dxcap.exe; C:\Windows\SysWOW64\dxcap.exe.
dxcap dxcap Sandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Launch specified executable as a subprocess of dxcap.exe. Note that you should have write permissions in the current working directory for the command to succeed; alternatively, add '-file c:\path\to\writable\location.ext' as first argument. (Local execution of a process as a subprocess of dxcap.exe)
Dxcap.exe -c {PATH_ABSOLUTE:.exe} Once executed, `dxcap.exe` will execute `xperf.exe` in the same folder. Thus, if `dxcap.exe` is copied to a folder and an arbitrary executable is renamed to `xperf.exe`, `dxcap.exe` will spawn it. (Execute an arbitrary executable via trusted system executable.)
dxcap.exe -usage | Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_susp_dxcap.yml |
| ioc | dxcap.exe executing from outside of System32/SysWOW64 |
| ioc | dxcap.exe spawning Xperf.exe |
| ioc | Xperf.exe executing from unusual directories (if not running from ADK path) |
dxcap is a Windows LOLBin. DirectX diagnostics/debugger included with Visual Studio. Located at: C:\Windows\System32\dxcap.exe; C:\Windows\SysWOW64\dxcap.exe.