Dotnet.exe

Commands

1. AWL BypassUser T1218

   Execute code bypassing AWL

   dotnet.exe {PATH:.dll}

   dotnet.exe will execute any DLL even if applocker is enabled.

   os: Windows 7 and up with .NET installed

   Execute: DLL (.NET)

2. ExecuteUser T1218

   Execute DLL

   dotnet.exe {PATH:.dll}

   dotnet.exe will execute any DLL.

   os: Windows 7 and up with .NET installed

   Execute: DLL (.NET)

3. ExecuteUser T1059

   Execute arbitrary F# code

   dotnet.exe fsi

   dotnet.exe will open a console which allows for the execution of arbitrary F# commands

   os: Windows 10 and up with .NET SDK installed

   Execute: FSharp

4. AWL BypassUser T1218

   Execute code bypassing AWL

   dotnet.exe msbuild {PATH:.csproj}

   dotnet.exe with msbuild (SDK Version) will execute unsigned code

   os: Windows 10 and up with .NET Core installed

   Execute: CSharp

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_dotnet.yml
• BlockRule https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
• IOCdotnet.exe spawned an unknown process

Resources

• https://twitter.com/_felamos/status/1204705548668555264
• https://gist.github.com/bohops/3f645a7238d8022830ecf5511b3ecfbc
• https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/
• https://learn.microsoft.com/en-us/dotnet/fsharp/tools/fsharp-interactive/