Serpens AppDomainManager Hijacking via Suspicious .NET Config File Write

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects the creation or modification of '.config' or '.exe.config' files within commonly user-writable directories such as AppData, Temp, Downloads, or Desktop. These files are often used by .NET applications to define behavior, and attackers may manipulate them to perform activities such as assembly redirection, loading malicious DLLs, or altering security settings for elevated processes.