CmdID

CmdID / Commands

dtrace

Beginning with Windows Server 2025, dtrace is included as a built-in tool. Windows commands reference

On Windows, macOS 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

Beginning with Windows Server 2025, dtrace is included as a built-in tool. DTrace is a command-line utility that allows users to monitor and debug their system performance in real-time. With dtrace, users can dynamically instrument the kernel and user-space code without modifying the code itself. This powerful tool supports various data collection and analysis techniques, including aggregations, histograms, and tracing of user-level events. Probes can be specified in dtrace scripts where the script defines the probes to be monitored and the actions to be taken when the probes fire. A probe is a specific point in the code where data can be collected to perform these actions. NOTE: This built-in port of dtrace differs from the MSI installer of DTrace for Windows surrounding parameters and other capabilities. To learn more about DTrace for Windows, see DTrace on Windows. For a comprehensive guide on using DTrace, see the Dynamic Tracing Guide.

dtrace [-BCeFhlqSvVwYZ] [-b bufsz] [-c cmd] [-D name[=def]] [-I path]
[-L path] [-o output] [-p pid] [-s script] [-U name] [-x opt[=val]] [-X a|c|s|t]
[-y symbol path]
[-P provider [[ predicate ] action ]] [-m [ provider: ]
module [[ predicate ] action ]] [-f [[ provider: ] module: ]
func [[ predicate ] action ]] [-n [[[ provider: ] module: ] func: ]
name [[ predicate ] action ]] [-i probe-id [[ predicate ] action ]] [ args ... ]

To trace all system calls, print the name of the executable and the name of the system call being made, run

dtrace -n 'syscall:::entry { printf("%s called syscall %s", execname, probefunc); }'Identify
-nEnables or lists probes that match the specified probe name in an argument using the format _provider:module:function:name_, _module:function:name_, _function:name_, or _name_. Windows commands reference

This command traces the "function_name" function in the process with the specified PID and prints the name of the function, the PID of the process calling it, and the name of the executable.

dtrace -n 'pid$target::function_name:entry { printf("Function %s called by process %d (%s)", probefunc, pid, execname); }' -p <PID>Identify
-nEnables or lists probes that match the specified probe name in an argument using the format _provider:module:function:name_, _module:function:name_, _function:name_, or _name_. Windows commands reference
-pGrabs the specified process-ID (PID) and caches its symbol tables, which can be used to analyze the program's behavior. Windows commands reference
Show 27 options
-b <bufsz>Sets the size of the buffer used to store trace data, where _bufsz_ is the desired size of the buffer in bytes, kilobytes (k), megabytes (m), or gigabytes (g).
-c <cmd>Runs the specified command and exits once it completes, where _cmd_ is the command that you want to run before starting the trace. If more than one instance of -c is used, dtrace exits when all commands finish running and reports the exit status for each child process.
-CRuns the ucpp preprocessor on script files before running the trace.
-D <name>=<def>Defines a symbol when invoking the preprocessor, where _name_ is the name of the symbol to define, and _def_ is an optional value to assign to the symbol.
-eExits after compiling a request but before enabling probes.
-fEnables or lists probes that match the specified function name.
-hGenerates a header file with definitions for static probes.
-i <probe-id>Enables or lists probes that match the specified probe ID, where _probe-id_ is the identifier for the probe to be traced.
-I <path>Adds the specified directory to the preprocessor search path, where _path_ is the directory that you want to add that contain the _#include_ files.
-lLists probes that match specified criteria based on the -P, -m, -f, -n, -i, and -s parameters. If these parameters aren't specified, all probes are listed.
-L <path>Adds the specified directory to the library search path, where _path_ is the library directory that you want to add that contain common definitions.
-mEnables or lists probes that match the specified module name in an argument using the format _provider:module_ or _module_. If qualifiers aren't specified besides the module name, all probes with that module name are matched.
-nEnables or lists probes that match the specified probe name in an argument using the format _provider:module:function:name_, _module:function:name_, _function:name_, or _name_. If qualifiers aren't specified besides the probe name, all probes with that name are matched.
-o <output>Sets the output file for the trace data, where _output_ is the name of the file that you want to use for the trace data.
-p <pid>Grabs the specified process-ID (PID) and caches its symbol tables, which can be used to analyze the program's behavior.
-P <provider>Enables or lists probes that match the specified provider name, where _provider_ is the name of the provider. More than one instance of the -P parameter can be used at the same time.
-qSets quiet mode, which only outputs explicitly traced data.
-s <script>Enables or lists probes according to the specified D script, where _script_ is the name of the script that you want to run. If -e is specified, the program is compiled but no data collection is performed. If -l is specified, the program is compiled and the list of probes matched are displayed, but no data collection is performed. If -e or -l aren't specified, the program is compiled, data collection is performed according to the probes specified and tracing begins.
-SPrints the D-language compiler intermediate code for debugging to _stderr_.
-U <name>Undefines a symbol when invoking the preprocessor, where _name_ is the name of the symbol that you want to undefine.
-vSets verbose mode, which reports stability attributes and arguments.
-wPermits destructive actions when specified with the -s, -P, -m, -f, -n, or -i parameters. Destructive actions can include actions such as modifying kernel variables, changing the behavior of system calls, or crashing the system.
-x <opt>=<val>Enables or modifies the compiler and tracing options, where _opt_ is the name of the option that you want to enable or modify, and _val_ is an optional value.
-X <ac s t> Controls how strict the C code being compiled adheres to the ISO C standard when invoking the cpp. The available arguments are: - -Xa (default): provides ISO C plus K&R compatibility extensions with semantic changes required by ISO C. The predefined macro \_\_STDC__ has a value of 0 when cpp is invoked. - -Xc (conformance): Provides a strict conformant of ISO C without K&R C compatibility extensions. The predefined macro \_\_STDC__ has a value of 1 when cpp is invoked. - -Xs (K&R C): Provides K&R C only, and the \_\_STDC__ macro isn't defined when cpp is invoked. - -Xt (transition): Provides ISO C plus K&R C compatibility extensions without semantic changes required by ISO C. The predefined macro \_\_STDC__ has a value of 0 when cpp is invoked.
-y <symbol path>Sets the symbol search path for the dtrace script to resolve, where _symbol path_ is the path to the shared library or directory that contains the symbols. To learn more, see Symbol Paths.
-YUses the default symbol search path for the dtrace script.
-ZPermits probe descriptions that match zero probes for debugging.

macOS

from tldr-pages, CC BY 4.0

A simple interface to invoke the D language compiler, retrieve buffered trace, and print traced data from the DTrace kernel facility. Generic front-end to DTrace facility, requiring root privileges.

Set target data model for a specific architecture

dtrace -arch arch_nameIdentify

Claim anonymous tracing state and display the traced data

dtrace -aIdentify

Set principal trace buffer size. Supported units are k, m, g, or t

dtrace -b 2gIdentify

Compile the specified D Program source file

dtrace -s D_scriptIdentify

Run the specified command and exit upon its completion

dtrace -c commandIdentify

Specify function name to trace or list (-l option). The corresponding argument can include any of the probe description forms like provider:module:function, module:function, or function

dtrace -f functionIdentify

Grab the specified process ID, cache its symbol table, and exit upon completion

dtrace -p process_idIdentify

Combine different options for tracing function in a process

dtrace -a -b buffer_size -f function -p process_idIdentify

What detects it

Sigma process creation rules that name dtrace
highSuspicious Kernel Dump Using DtraceFlorian Roth (Nextron Systems)