Dotnet.exe Exec Dll and Execute Unsigned Code LOLBIN

dotnet.exe will execute any DLL and execute unsigned code

Sigma rule (View on GitHub)

 1title: Dotnet.exe Exec Dll and Execute Unsigned Code LOLBIN
 2id: d80d5c81-04ba-45b4-84e4-92eba40e0ad3
 3status: test
 4description: dotnet.exe will execute any DLL and execute unsigned code
 5references:
 6    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/
 7    - https://twitter.com/_felamos/status/1204705548668555264
 8    - https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/
 9author: Beyu Denis, oscd.community
10date: 2020/10/18
11modified: 2023/02/04
12tags:
13    - attack.defense_evasion
14    - attack.t1218
15logsource:
16    category: process_creation
17    product: windows
18detection:
19    selection_img:
20        - Image|endswith: '\dotnet.exe'
21        - OriginalFileName: '.NET Host'
22    selection_cli:
23        CommandLine|endswith:
24            - '.dll'
25            - '.csproj'
26    condition: all of selection_*
27fields:
28    - ComputerName
29    - User
30    - CommandLine
31    - ParentCommandLine
32falsepositives:
33    - System administrator Usage
34level: medium

References

Related rules

to-top