windows enabled community high v1.0.0

dxcap

DirectX diagnostics/debugger included with Visual Studio. Located at: C:\Windows\System32\dxcap.exe; C:\Windows\SysWOW64\dxcap.exe.

📋 Live Preview
dxcap
dxcap

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Launch specified executable as a subprocess of dxcap.exe. Note that you should have write permissions in the current working directory for the command to succeed; alternatively, add '-file c:\path\to\writable\location.ext' as first argument. (Local execution of a process as a subprocess of dxcap.exe)

Dxcap.exe -c {PATH_ABSOLUTE:.exe}

Once executed, `dxcap.exe` will execute `xperf.exe` in the same folder. Thus, if `dxcap.exe` is copied to a folder and an arbitrary executable is renamed to `xperf.exe`, `dxcap.exe` will spawn it. (Execute an arbitrary executable via trusted system executable.)

dxcap.exe -usage

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_susp_dxcap.yml
ioc dxcap.exe executing from outside of System32/SysWOW64
ioc dxcap.exe spawning Xperf.exe
ioc Xperf.exe executing from unusual directories (if not running from ADK path)

Documentation

dxcap

dxcap is a Windows LOLBin. DirectX diagnostics/debugger included with Visual Studio. Located at: C:\Windows\System32\dxcap.exe; C:\Windows\SysWOW64\dxcap.exe.

References