dotnet-counters.exe

Launches the specified executable as a child process while collecting performance counter data for 1 second.

Use Execute a child process under the guise of a legitimate .NET diagnostic tool.

dotnet-counters.exe collect --duration 1 -- {PATH:.exe}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1127

Detection

IOC: Process creation with command line containing "dotnet-counters collect" and "--"

Refs

learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-counters

github.com/dotnet/diagnostics

lolbas-project.github.io/lolbas/OtherMSBinaries/dotnet-counters/