Sigma rule: Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE

Rule

Title

Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE

Status

test

Level

medium

Author

Beyu Denis, oscd.community

Date

2020-10-18

Modified

2025-10-08

File

rules/windows/process_creation/proc_creation_win_dotnet_arbitrary_dll_csproj_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\dotnet.exe'
    - OriginalFileName: '.NET Host'
selection_cli:
    CommandLine|endswith:
        - '.csproj'
        - '.csproj"'
        - '.dll'
        - '.dll"'
        - ".csproj'"
        - ".dll'"
filter_optional_notepadplus_plus:
    ParentImage:
        - 'C:\Program Files (x86)\Notepad++\notepad++.exe'
        - 'C:\Program Files\Notepad++\notepad++.exe'
    CommandLine|contains|all:
        - 'C:\ProgramData\CSScriptNpp\'
        - '-cscs_path:'
        - '\cs-script\cscs.dll'
condition: all of selection_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate administrator usage

Tags

• attack.stealth
• attack.t1218

MITRE ATT&CK ids this rule names

• T1218

References

• https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/
• https://twitter.com/_felamos/status/1204705548668555264
• https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_dotnet_arbitrary_dll_csproj_execution.yml