Windows: Arbitrary DLL or .csproj Code Execution via dotnet.exe

title: "Windows: Arbitrary DLL or .csproj Code Execution via dotnet.exe"
id: 61ac7ee2-0f8c-4f29-a6b5-e66e34236bfc
status: test
description: This rule flags process executions where dotnet.exe is launched with command-line arguments ending in .csproj or .dll, indicating potential compilation or loading of untrusted .NET components. Attackers can use dotnet.exe to execute or load arbitrary .NET assemblies and project files, often blending in with normal .NET tooling. The detection relies on Windows process creation telemetry, specifically the image name, original file name, and command-line suffixes.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/
  - https://twitter.com/_felamos/status/1204705548668555264
  - https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dotnet_arbitrary_dll_csproj_execution.yml
author: Beyu Denis, oscd.community, Huntrule Team
date: 2020-10-18
modified: 2025-10-08
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \dotnet.exe
    - OriginalFileName: .NET Host
  selection_cli:
    CommandLine|endswith:
      - .csproj
      - .csproj"
      - .dll
      - .dll"
      - .csproj'
      - .dll'
  filter_optional_notepadplus_plus:
    ParentImage:
      - C:\Program Files (x86)\Notepad++\notepad++.exe
      - C:\Program Files\Notepad++\notepad++.exe
    CommandLine|contains|all:
      - C:\ProgramData\CSScriptNpp\
      - "-cscs_path:"
      - \cs-script\cscs.dll
  condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate administrator usage
level: medium
license: DRL-1.1
related:
  - id: d80d5c81-04ba-45b4-84e4-92eba40e0ad3
    type: derived