Windows: Execution of dnx.exe may indicate an application whitelisting bypass

Alerts on execution of dnx.exe, a .NET-based utility that can be abused to bypass application whitelisting.

FreeUnreviewedSigmamediumv1

windows-execution-of-dnx-exe-may-indicate-an-application-whitelisting-bypass-81ebd28b

title: "Windows: Execution of dnx.exe may indicate an application whitelisting bypass"
id: 4b6ba094-feae-4f02-be7b-a4b3a8f5e6ef
status: test
description: This rule flags process creation events where the executed image ends with dnx.exe. dnx.exe can be used to run C# code, which may enable attackers to execute payloads while attempting to evade application allowlisting controls. It relies on Windows process creation telemetry that includes the process image path or filename.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/
  - https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dnx_execute_csharp_code.yml
author: Beyu Denis, oscd.community, Huntrule Team
date: 2019-10-26
modified: 2024-04-24
tags:
  - attack.stealth
  - attack.t1218
  - attack.t1027.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \dnx.exe
  condition: selection
falsepositives:
  - Legitimate use of dnx.exe by legitimate user
level: medium
license: DRL-1.1
related:
  - id: 81ebd28b-9607-4478-bf06-974ed9d53ed7
    type: derived

What it detects

This rule flags process creation events where the executed image ends with dnx.exe. dnx.exe can be used to run C# code, which may enable attackers to execute payloads while attempting to evade application allowlisting controls. It relies on Windows process creation telemetry that includes the process image path or filename.

Known false positives

Legitimate use of dnx.exe by legitimate user

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.