.. / Dotnet.exe
Star

dotnet.exe comes with .NET Framework


Paths:

Resources:
Acknowledgements:

Detection:

AWL bypass

dotnet.exe will execute any dll even if applocker is enabled.
dotnet.exe [PATH_TO_DLL]
Usecase:
Privileges required: User
OS: Windows 7 and up with .NET installed
MITRE ATT&CK®: T1218



dotnet.exe with msbuild (SDK Version) will execute unsigned code
dotnet.exe msbuild [Path_TO_XML_CSPROJ]
Usecase:
Privileges required: User
OS: Windows 10 with .NET Core installed
MITRE ATT&CK®: T1218



Execute

dotnet.exe will execute any DLL.
dotnet.exe [PATH_TO_DLL]
Usecase: Execute DLL
Privileges required: User
OS: Windows 7 and up with .NET installed
MITRE ATT&CK®: T1218