dotnet-trace.exe — LOLBAS

Execute

Execution Windows

Launches the specified executable as a child process while collecting runtime trace data for 1 second during execution.

Use Execute a child process under the guise of a legitimate .NET diagnostic tool.

dotnet-trace.exe collect --duration 00:00:01 -- {PATH:.exe}

Context: user
Native: Execute
MITRE: T1127
Detection: IOC: Process creation with command line containing "dotnet-trace collect" and "--"
Refs: learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-trace
github.com/dotnet/diagnostics
lolbas-project.github.io/lolbas/OtherMSBinaries/dotnet-trace/