How can I use tracker.exe to load a DLL and bypass application whitelisting?
tracker.exe, a Microsoft-signed binary from the Windows SDK, can load a DLL into any process you start using the `/d` option. For example, `Tracker.exe /d test.dll /c cmd.exe` injects test.dll into cmd.exe. Because tracker.exe is digitally signed, it can bypass application whitelisting controls. However, if the target process exits quickly, as with svchost.exe, the DLL still gets loaded. See the full details in Study Notes Weekly No.4.
tracker.exeDLL injectionapplication whitelisting bypassMicrosoft signed binary