Windows Registry Set: .NET COR/CORECLR Profiling Environment Variables Enabled
Alerts on registry writes enabling .NET CLR/CORECLR profiling variables like COR_ENABLE_PROFILING and COR_PROFILER.
- Product
- windows
- Category
- registry_set
- Author
- Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research), Jimmy Bayne (@bohops) (SigmaHQ), DRL 1.1
- Published
- 2020-09-10
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows registry writes where .NET CLR and .NET Core CLR profiling environment variables are set, specifically COR_ENABLE_PROFILING and COR_PROFILER (and their CORECLR equivalents). Attackers can use CLR profiling configuration to influence runtime behavior and load attacker-controlled components early in process execution. It relies on registry_set telemetry and matches the TargetObject naming and path contents for the relevant variable entries, including CORECLR_PROFILER_PATH.
Reporting behind it
- twitter.comhttps://twitter.com/jamieantisocial/status/1304520651248668673
- slideshare.nethttps://www.slideshare.net/JamieWilliams130/started-from-the-bottom-exploiting-data-sources-to-uncover-attck-behaviors
- sans.orghttps://www.sans.org/cyber-security-summit/archives
- learn.microsoft.comhttps://learn.microsoft.com/en-us/dotnet/core/runtime-config/debugging-profiling
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_enabling_cor_profiler_env_variables.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry Set: .NET COR/CORECLR Profiling Environment Variables Enabled"
id: 911703cc-5f09-4ef5-9211-59527381edc3
status: test
description: This rule flags Windows registry writes where .NET CLR and .NET Core CLR profiling environment variables are set, specifically COR_ENABLE_PROFILING and COR_PROFILER (and their CORECLR equivalents). Attackers can use CLR profiling configuration to influence runtime behavior and load attacker-controlled components early in process execution. It relies on registry_set telemetry and matches the TargetObject naming and path contents for the relevant variable entries, including CORECLR_PROFILER_PATH.
references:
- https://twitter.com/jamieantisocial/status/1304520651248668673
- https://www.slideshare.net/JamieWilliams130/started-from-the-bottom-exploiting-data-sources-to-uncover-attck-behaviors
- https://www.sans.org/cyber-security-summit/archives
- https://learn.microsoft.com/en-us/dotnet/core/runtime-config/debugging-profiling
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_enabling_cor_profiler_env_variables.yml
author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research), Jimmy Bayne (@bohops), Huntrule Team
date: 2020-09-10
modified: 2023-11-24
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.012
logsource:
category: registry_set
product: windows
detection:
selection_1:
TargetObject|endswith:
- \COR_ENABLE_PROFILING
- \COR_PROFILER
- \CORECLR_ENABLE_PROFILING
selection_2:
TargetObject|contains: \CORECLR_PROFILER_PATH
condition: 1 of selection_*
level: medium
license: DRL-1.1
related:
- id: ad89044a-8f49-4673-9a55-cbd88a1b374f
type: derived