dotnet-counters.exe

Commands

1. ExecuteUser T1127

   Execute a child process under the guise of a legitimate .NET diagnostic tool.

   dotnet-counters.exe collect --duration 1 -- {PATH:.exe}

   Launches the specified executable as a child process while collecting performance counter data for 1 second.

   os: Windows 10, Windows 11

   Execute: EXE

Detection

• IOCProcess creation with command line containing "dotnet-counters collect" and "--"

Code samples

• https://github.com/dotnet/diagnostics/tree/main/src/Tools/dotnet-counters

Resources

• https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-counters
• https://github.com/dotnet/diagnostics