Skip to content

LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Dotnet.exe

dotnet.exe comes with .NET Framework

AWL Bypass Execute

04COMMAND EXAMPLES

02ATT&CK TECHNIQUES

02DETECTION RESOURCES

02CAPABILITIES

01 / TRADECRAFT

Command reference

4 examples

AWL Bypass2

EXAMPLE 01T1218

dotnet.exe will execute any DLL even if applocker is enabled.

COMMAND

dotnet.exe {PATH:.dll}

USE CASE: Execute code bypassing AWL
PRIVILEGES: User
OPERATING SYSTEM: Windows 7 and up with .NET installed

Execute · DLL (.NET)

EXAMPLE 02T1218

dotnet.exe with msbuild (SDK Version) will execute unsigned code

COMMAND

dotnet.exe msbuild {PATH:.csproj}

USE CASE: Execute code bypassing AWL
PRIVILEGES: User
OPERATING SYSTEM: Windows 10 and up with .NET Core installed

Execute · CSharp

Execute2

EXAMPLE 01T1218

dotnet.exe will execute any DLL.

COMMAND

dotnet.exe {PATH:.dll}

USE CASE: Execute DLL
PRIVILEGES: User
OPERATING SYSTEM: Windows 7 and up with .NET installed

Execute · DLL (.NET)

EXAMPLE 02T1059

dotnet.exe will open a console which allows for the execution of arbitrary F# commands

COMMAND

dotnet.exe fsi

USE CASE: Execute arbitrary F# code
PRIVILEGES: User
OPERATING SYSTEM: Windows 10 and up with .NET SDK installed

Execute · FSharp

02 / ON DISK

Known paths

C:\Program Files\dotnet\dotnet.exe

03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

Indicators & detection notes

IOC
dotnet.exe spawned an unknown process

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

felamos@_felamos

Jimmy@bohops

yamalon@mavinject