Tracker.exe

Tool included with Microsoft .Net Framework.

AWL Bypass

Injection of locally stored DLL file into target process.

Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exe

Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions. — MITRE: T1127 — Privileges: User

Execute

Injection of locally stored DLL file into target process.

Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exe

Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions. — MITRE: T1127 — Privileges: User