LOL · OtherMSBinary

Dotnet.exe

4 techniques WindowsLOLBAS GPL-3.0

AWL Bypass

AWL / Policy Bypass Windows

dotnet.exe will execute any DLL even if applocker is enabled.

Use Execute code bypassing AWL

dotnet.exe {PATH:.dll}

Context: user
Native: AWL Bypass
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_dotnet.yml
BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
IOC: dotnet.exe spawned an unknown process
Refs: twitter.com/_felamos/status/1204705548668555264
gist.github.com/bohops/3f645a7238d8022830ecf5511b3ecfbc
bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/
learn.microsoft.com/en-us/dotnet/fsharp/tools/fsharp-interactive/
lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/

Execution Windows

dotnet.exe will execute any DLL.

Use Execute DLL

dotnet.exe {PATH:.dll}

Context: user
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_dotnet.yml
BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
IOC: dotnet.exe spawned an unknown process
Refs: twitter.com/_felamos/status/1204705548668555264
gist.github.com/bohops/3f645a7238d8022830ecf5511b3ecfbc
bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/
learn.microsoft.com/en-us/dotnet/fsharp/tools/fsharp-interactive/
lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/

Execution Windows

dotnet.exe will open a console which allows for the execution of arbitrary F# commands

Use Execute arbitrary F# code

dotnet.exe fsi

Context: user
Native: Execute
MITRE: T1059
Detection: Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_dotnet.yml
BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
IOC: dotnet.exe spawned an unknown process
Refs: twitter.com/_felamos/status/1204705548668555264
gist.github.com/bohops/3f645a7238d8022830ecf5511b3ecfbc
bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/
learn.microsoft.com/en-us/dotnet/fsharp/tools/fsharp-interactive/
lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/

AWL / Policy Bypass Windows

dotnet.exe with msbuild (SDK Version) will execute unsigned code

Use Execute code bypassing AWL

dotnet.exe msbuild {PATH:.csproj}

Context: user
Native: AWL Bypass
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_dotnet.yml
BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
IOC: dotnet.exe spawned an unknown process
Refs: twitter.com/_felamos/status/1204705548668555264
gist.github.com/bohops/3f645a7238d8022830ecf5511b3ecfbc
bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/
learn.microsoft.com/en-us/dotnet/fsharp/tools/fsharp-interactive/
lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/