Windows PowerShell Script Block: Registry-free COR_PROFILER Environment Variable Usage

title: "Windows PowerShell Script Block: Registry-free COR_PROFILER Environment Variable Usage"
id: 9a3e2fad-06ef-4b3a-8f8c-26bbfbf58307
status: test
description: This rule flags PowerShell script blocks that reference the .NET CLR profiling environment variables COR_ENABLE_PROFILING, COR_PROFILER, and COR_PROFILER_PATH. Attackers can use these variables to influence unmanaged profiler DLL loading into processes that load the CLR, enabling execution flow hijacking or stealthy instrumentation. The detection relies on Script Block Logging telemetry capturing these environment variable strings in the script content.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.012/T1574.012.md#atomic-test-3---registry-free-process-scope-cor_profiler
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_cor_profiler.yml
author: frack113, Huntrule Team
date: 2021-12-30
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.012
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - $env:COR_ENABLE_PROFILING
      - $env:COR_PROFILER
      - $env:COR_PROFILER_PATH
  condition: selection
falsepositives:
  - Legitimate administrative script
level: medium
license: DRL-1.1
related:
  - id: 23590215-4702-4a70-8805-8dc9e58314a2
    type: derived