← cd ..OtherMSBinaries

dotnet-trace.exe

.NET diagnostic tool for collecting runtime traces from .NET applications. Installed via ‘dotnet tool install –global dotnet-trace’ (.NET SDK required).

Full path

C:\Users\<user>\.dotnet\tools\dotnet-trace.exe

Commands

ExecuteUser T1127
Execute a child process under the guise of a legitimate .NET diagnostic tool.
```
dotnet-trace.exe collect --duration 00:00:01 -- {PATH:.exe}
```
Launches the specified executable as a child process while collecting runtime trace data for 1 second during execution.
os: Windows 10, Windows 11
Execute: EXE

Detection

IOCProcess creation with command line containing "dotnet-trace collect" and "--"

Code samples

https://github.com/dotnet/diagnostics/tree/main/src/Tools/dotnet-trace

Resources

https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-trace
https://github.com/dotnet/diagnostics

acknowledgement: Iván Cabrera @ivancabrera02