Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
8
1
1
1
1
Contributors
4
3
2
1
1
Categories
5
2
1
1
1
Platforms
11
1
Products / Services
2
2
1
1
1
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
IDS Classtypes
1
IDS Protocols
1
Detects processes associated with the WinGet/DSC configuration engine (ConfigurationRemotingServer.exe, WindowsPackageManagerServer.exe, or winget.exe) initiating processes with the COR_PROFILER or COR_ENABLE_PROFILING environment variables. This behavior is indicative of leveraging .NET profiler hijacking via the DSC 'Environment' resource for persistence or privilege escalation.
Detects COR_PROFILER environment variable abuse for .NET DLL hijacking
This rule detects the delivery of a payload associated with a COR_PROFILER DLL hijacking technique. It specifically looks for HTTP traffic flowing to the client that contains both the string "COR_PROFILER" and the file extension ".dll" (case-insensitive) within the file data. This indicates an attempt to deliver a malicious DLL that could be used for persistence or privilege escalation by exploiting the COR_PROFILER environment variable.
Detects the creation of an NT Object Manager symbolic link pointing to CTF.AsmListCache.FMPWinlogon paths, indicative of GreenPlasma Stage 1. This activity is captured via Windows Security Event 4663 (Object Access) and specifically filters for 'SymbolicLinkObject' creation where the object name contains 'CTF.AsmListCache.FMPWinlogon'.
Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR.
The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR).
These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.
(Citation: Microsoft Profiling Mar 2017)
(Citation: Microsoft COR_PROFILER Feb 2013)
The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR).
These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.
(Citation: Microsoft Profiling Mar 2017)
(Citation: Microsoft COR_PROFILER Feb 2013)
Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.
This rule detects attempts to leverage the COR_PROFILER environment variable for process scope hijacking. Adversaries may use COR_PROFILER to load a malicious DLL into .NET processes, enabling persistence, privilege escalation, or defense evasion. The detection specifically looks for PowerShell script block text that sets the COR_ENABLE_PROFILING, COR_PROFILER, and COR_PROFILER_PATH environment variables, which are indicative of this technique.
Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.
Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR.
The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR).
These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.
(Citation: Microsoft Profiling Mar 2017)
(Citation: Microsoft COR_PROFILER Feb 2013)
The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR).
These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.
(Citation: Microsoft Profiling Mar 2017)
(Citation: Microsoft COR_PROFILER Feb 2013)
Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.
The following analytic detects modifications to the registry aimed at bypassing the User Account Control (UAC) feature in Windows. It identifies changes to the .NET COR_PROFILER_PATH registry key, which can be exploited to load a malicious DLL via mmc.exe. This detection leverages data from the Endpoint.Registry datamodel, focusing on specific registry paths and values. Monitoring this activity is crucial as it can indicate an attempt to escalate privileges or persist within the environment. If confirmed malicious, this could allow an attacker to execute arbitrary code with elevated privileges, compromising system integrity.
Detects the modification or creation of registry values related to .NET Framework CLR and .NET Core CLR profiling. Specifically, it looks for 'COR_ENABLE_PROFILING', 'COR_PROFILER', 'CORECLR_ENABLE_PROFILING', and 'CORECLR_PROFILER_PATH' being set. Adversaries can abuse these environment variables to load malicious DLLs into .NET processes for persistence, privilege escalation, or defense evasion.