A logging configuration tool from the Windows Kits used to start and manage process logging. Located at: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\logger.exe; C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\logger.exe; C:\Program Files\Windows Kits\10\Debuggers\x86\logger.exe.
loggerloggerSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Executes the command specified after the `RUN` parameter as a child of `logger.exe`. (Executes an abitrary command via a signed binary to evade detection.)
logger.exe RUN "{CMD}"Executes the command specified after the `RUNW` parameter as a child of `logger.exe`. (Executes an abitrary command via a signed binary to evade detection.)
logger.exe RUNW "{CMD}"Executes the command specified as a child of `logger.exe`. (Executes an abitrary command via a signed binary to evade detection.)
logger.exe "{CMD}"logger is a Windows LOLBin. A logging configuration tool from the Windows Kits used to start and manage process logging. Located at: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\logger.exe; C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\logger.exe; C:\Program Files\Windows Kits\10\Debuggers\x86\logger.exe.