Binary Proxy Execution Via Dotnet-Trace.EXE

Title: Binary Proxy Execution Via Dotnet-Trace.EXE
Status: test
Description:Detects commandline arguments for executing a child process via dotnet-trace.exe
References:
  -https://twitter.com/bohops/status/1740022869198037480
Author: Jimmy Bayne (@bohops)
Date: 2024-01-02
modified:None
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\dotnet-trace.exe' OriginalFileName:'dotnet-trace.dll'   selection_cli:
    CommandLine|contains|all:
      -'-- '
      -'collect'

  condition:all of selection_*
Falsepositives:
  -Legitimate usage of the utility in order to debug and trace a program.
Level: medium