Windows Process Execution Using dotnet-trace.exe Proxy Arguments

Alerts on dotnet-trace.exe executions with '-- ' and 'collect' command-line arguments that may proxy child process execution.

FreeUnreviewedSigmamediumv1

windows-process-execution-using-dotnet-trace-exe-proxy-arguments-9257c05b

title: Windows Process Execution Using dotnet-trace.exe Proxy Arguments
id: 02c14db6-8956-4572-86fc-83a2df415384
status: test
description: This rule flags Windows process creation events where the image ends with dotnet-trace.exe and the command line includes the arguments '-- ' and 'collect'. The pattern indicates use of dotnet-trace.exe to spawn or proxy execution of another process, which can be leveraged to hide malicious activity within legitimate tooling. It relies on process creation telemetry, including the process image name and full command line.
references:
  - https://twitter.com/bohops/status/1740022869198037480
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dotnet_trace_lolbin_execution.yml
author: Jimmy Bayne (@bohops), Huntrule Team
date: 2024-01-02
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \dotnet-trace.exe
    - OriginalFileName: dotnet-trace.dll
  selection_cli:
    CommandLine|contains|all:
      - "-- "
      - collect
  condition: all of selection_*
falsepositives:
  - Legitimate usage of the utility in order to debug and trace a program.
level: medium
license: DRL-1.1
related:
  - id: 9257c05b-4a4a-48e5-a670-b7b073cf401b
    type: derived

What it detects

This rule flags Windows process creation events where the image ends with dotnet-trace.exe and the command line includes the arguments '-- ' and 'collect'. The pattern indicates use of dotnet-trace.exe to spawn or proxy execution of another process, which can be leveraged to hide malicious activity within legitimate tooling. It relies on process creation telemetry, including the process image name and full command line.

Known false positives

Legitimate usage of the utility in order to debug and trace a program.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.