Windows: Dotnet.exe executes arbitrary DLL or csproj files
Alerts when dotnet.exe runs with .csproj or .dll arguments that may indicate loading or execution of untrusted .NET code.
- Product
- windows
- Category
- process_creation
- Author
- Beyu Denis, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-18
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions where dotnet.exe is launched with command-line arguments ending in .csproj or .dll, indicating potential execution of attacker-controlled build or library artifacts. Such behavior matters because it can enable stealthy code execution paths that blend into normal .NET tooling. Telemetry relies on Windows process creation events, including the process image (dotnet.exe) and the full command line.
Reporting behind it
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/
- twitter.comhttps://twitter.com/_felamos/status/1204705548668555264
- bohops.comhttps://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dotnet_arbitrary_dll_csproj_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Dotnet.exe executes arbitrary DLL or csproj files"
id: 61ac7ee2-0f8c-4f29-a6b5-e66e34236bfc
status: test
description: This rule flags process executions where dotnet.exe is launched with command-line arguments ending in .csproj or .dll, indicating potential execution of attacker-controlled build or library artifacts. Such behavior matters because it can enable stealthy code execution paths that blend into normal .NET tooling. Telemetry relies on Windows process creation events, including the process image (dotnet.exe) and the full command line.
references:
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/
- https://twitter.com/_felamos/status/1204705548668555264
- https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dotnet_arbitrary_dll_csproj_execution.yml
author: Beyu Denis, oscd.community, Huntrule Team
date: 2020-10-18
modified: 2025-10-08
tags:
- attack.stealth
- attack.t1218
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \dotnet.exe
- OriginalFileName: .NET Host
selection_cli:
CommandLine|endswith:
- .csproj
- .csproj"
- .dll
- .dll"
- .csproj'
- .dll'
filter_optional_notepadplus_plus:
ParentImage:
- C:\Program Files (x86)\Notepad++\notepad++.exe
- C:\Program Files\Notepad++\notepad++.exe
CommandLine|contains|all:
- C:\ProgramData\CSScriptNpp\
- "-cscs_path:"
- \cs-script\cscs.dll
condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
- Legitimate administrator usage
level: medium
license: DRL-1.1
related:
- id: d80d5c81-04ba-45b4-84e4-92eba40e0ad3
type: derived