Windows: Process Creation of Dnx.EXE May Indicate Application Whitelisting Bypass

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1027.004Compile After Delivery
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule triggers when Dnx.EXE is executed on Windows. Dnx can run C# code, which may be abused to circumvent application allowlisting controls. The detection relies on process creation telemetry, specifically the image path ending with \dnx.exe.

Reporting behind it

Related detections9 linkedT1218 — drag to rearrange

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

Malicious DLL Execution via Wuauclt Update Handler (via process_creation)

Malicious aspnet_compiler.exe Injection Host Spawned by PowerShell via process_creation

Malicious regsvcs LOLBin Loading Ransomware DLL from UNC Path

Suspicious RegAsm or RegSvcs Spawned by Script Host (via process_creation)

Suspicious Extexport DLL Side-Loading Execution

Malicious ClickFix Execution Chain Spawning MSHTA via Pcalua on EtherRAT Infection

Suspicious TALONITE Certutil LOLBIN Decode and Download Abuse (via process_creation)

Suspicious Renamed git Binary gcmd.exe Execution (via process_creation)

Windows: Process Creation of Dnx.EXE May Indicate Application Whitelisting Bypass

Pivot detection · T1218 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-execution-of-dnx-exe-may-indicate-an-application-whitelisting-bypass-81ebd28b

title: "Windows: Process Creation of Dnx.EXE May Indicate Application Whitelisting Bypass"
id: 4b6ba094-feae-4f02-be7b-a4b3a8f5e6ef
status: test
description: This rule triggers when Dnx.EXE is executed on Windows. Dnx can run C# code, which may be abused to circumvent application allowlisting controls. The detection relies on process creation telemetry, specifically the image path ending with \dnx.exe.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/
  - https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dnx_execute_csharp_code.yml
author: Beyu Denis, oscd.community, Huntrule Team
date: 2019-10-26
modified: 2024-04-24
tags:
  - attack.stealth
  - attack.t1218
  - attack.t1027.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \dnx.exe
  condition: selection
falsepositives:
  - Legitimate use of dnx.exe by legitimate user
level: medium
license: DRL-1.1
related:
  - id: 81ebd28b-9607-4478-bf06-974ed9d53ed7
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL