.. / Dotnet.exe
Star

dotnet.exe comes with .NET Framework


Paths:


Resources:
https://twitter.com/_felamos/status/1204705548668555264

Acknowledgement:
felamos - @_felamos


Detection:
dotnet.exe spawned an unknown process



AWL bypass

dotnet.exe will execute any dll even if applocker is enabled.
dotnet.exe [PATH_TO_DLL]
Usecase:
Privileges required:User
OS:Windows 7 and up with .NET installed
Mitre:T1218



Execute

dotnet.exe will execute any DLL.
dotnet.exe [PATH_TO_DLL]
Usecase:Execute DLL
Privileges required:User
OS:Windows 7 and up with .NET installed
Mitre:T1218