Windows Process Execution of dotnet-trace.exe Child via '-- collect' Arguments
Alerts on dotnet-trace.exe executions with '-- ' and 'collect' command-line arguments that may proxy child process execution.
- Product
- windows
- Category
- process_creation
- Author
- Jimmy Bayne (@bohops) (SigmaHQ), DRL 1.1
- Published
- 2024-01-02
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process creation where dotnet-trace.exe is launched with command-line content consistent with spawning a child process, indicated by the presence of '-- ' and 'collect'. Attackers may use this execution pattern to proxy or run additional payloads while blending into legitimate .NET diagnostic tooling. The detection relies on process creation telemetry including the executable image name and the full command line.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Execution of dotnet-trace.exe Child via '-- collect' Arguments
id: 02c14db6-8956-4572-86fc-83a2df415384
status: test
description: This rule identifies Windows process creation where dotnet-trace.exe is launched with command-line content consistent with spawning a child process, indicated by the presence of '-- ' and 'collect'. Attackers may use this execution pattern to proxy or run additional payloads while blending into legitimate .NET diagnostic tooling. The detection relies on process creation telemetry including the executable image name and the full command line.
references:
- https://twitter.com/bohops/status/1740022869198037480
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dotnet_trace_lolbin_execution.yml
author: Jimmy Bayne (@bohops), Huntrule Team
date: 2024-01-02
tags:
- attack.execution
- attack.stealth
- attack.t1218
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \dotnet-trace.exe
- OriginalFileName: dotnet-trace.dll
selection_cli:
CommandLine|contains|all:
- "-- "
- collect
condition: all of selection_*
falsepositives:
- Legitimate usage of the utility in order to debug and trace a program.
level: medium
license: DRL-1.1
related:
- id: 9257c05b-4a4a-48e5-a670-b7b073cf401b
type: derived