Registry-Free Process Scope COR_PROFILER Environment Variable Manipulation
This rule detects attempts to leverage the COR_PROFILER environment variable for process scope hijacking. Adversaries may use COR_PROFILER to load a malicious DLL into .NET processes, enabling persistence, privilege escalation, or defense evasion. The detection specifically looks for PowerShell script block text that sets the COR_ENABLE_PROFILING, COR_PROFILER, and COR_PROFILER_PATH environment variables, which are indicative of this technique.
Sigma
