Dotnet.exe

dotnet.exe will execute any DLL even if applocker is enabled.

Use Execute code bypassing AWL

dotnet.exe {PATH:.dll}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

AWL Bypass

MITRE

T1218

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_dotnet.yml

BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

IOC: dotnet.exe spawned an unknown process

Refs

twitter.com/_felamos/status/1204705548668555264

gist.github.com/bohops/3f645a7238d8022830ecf5511b3ecfbc

bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/

learn.microsoft.com/en-us/dotnet/fsharp/tools/fsharp-interactive/

lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/

dotnet.exe will execute any DLL.

Use Execute DLL

dotnet.exe {PATH:.dll}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_dotnet.yml

BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

IOC: dotnet.exe spawned an unknown process

Refs

twitter.com/_felamos/status/1204705548668555264

gist.github.com/bohops/3f645a7238d8022830ecf5511b3ecfbc

bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/

learn.microsoft.com/en-us/dotnet/fsharp/tools/fsharp-interactive/

lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/

dotnet.exe will open a console which allows for the execution of arbitrary F# commands

Use Execute arbitrary F# code

dotnet.exe fsi

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1059

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_dotnet.yml

BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

IOC: dotnet.exe spawned an unknown process

Refs

twitter.com/_felamos/status/1204705548668555264

gist.github.com/bohops/3f645a7238d8022830ecf5511b3ecfbc

bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/

learn.microsoft.com/en-us/dotnet/fsharp/tools/fsharp-interactive/

lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/

dotnet.exe with msbuild (SDK Version) will execute unsigned code

Use Execute code bypassing AWL

dotnet.exe msbuild {PATH:.csproj}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

AWL Bypass

MITRE

T1218

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_dotnet.yml

BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

IOC: dotnet.exe spawned an unknown process

Refs

twitter.com/_felamos/status/1204705548668555264

gist.github.com/bohops/3f645a7238d8022830ecf5511b3ecfbc

bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/

learn.microsoft.com/en-us/dotnet/fsharp/tools/fsharp-interactive/

lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/