Windows Registry Set: .NET COR/CORECLR Profiling Environment Variables Enabled

title: "Windows Registry Set: .NET COR/CORECLR Profiling Environment Variables Enabled"
id: 911703cc-5f09-4ef5-9211-59527381edc3
status: test
description: This rule flags Windows registry writes where .NET CLR and .NET Core CLR profiling environment variables are set, specifically COR_ENABLE_PROFILING and COR_PROFILER (and their CORECLR equivalents). Attackers can use CLR profiling configuration to influence runtime behavior and load attacker-controlled components early in process execution. It relies on registry_set telemetry and matches the TargetObject naming and path contents for the relevant variable entries, including CORECLR_PROFILER_PATH.
references:
  - https://twitter.com/jamieantisocial/status/1304520651248668673
  - https://www.slideshare.net/JamieWilliams130/started-from-the-bottom-exploiting-data-sources-to-uncover-attck-behaviors
  - https://www.sans.org/cyber-security-summit/archives
  - https://learn.microsoft.com/en-us/dotnet/core/runtime-config/debugging-profiling
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_enabling_cor_profiler_env_variables.yml
author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research), Jimmy Bayne (@bohops), Huntrule Team
date: 2020-09-10
modified: 2023-11-24
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.012
logsource:
  category: registry_set
  product: windows
detection:
  selection_1:
    TargetObject|endswith:
      - \COR_ENABLE_PROFILING
      - \COR_PROFILER
      - \CORECLR_ENABLE_PROFILING
  selection_2:
    TargetObject|contains: \CORECLR_PROFILER_PATH
  condition: 1 of selection_*
level: medium
license: DRL-1.1
related:
  - id: ad89044a-8f49-4673-9a55-cbd88a1b374f
    type: derived