Identifier / Programs / Windows
dotnet.exe
Cross platform .NET tools for .NET Core. Some subcommands such as build have their own usage documentation. tldr-pages
LOLBAS AWL Bypass, Execute 1 Sigma rule name it 2 ATT&CK techniques 4 documented commands 2 known copies with hashes
How dotnet.exe is abused
AWL Bypass T1218 System Binary Proxy Execution
Execute T1218 System Binary Proxy Execution
Execute T1059 Command and Scripting Interpreter
fsi
AWL Bypass T1218 System Binary Proxy Execution
msbuild
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for dotnet.exe.
4 documented commands
AWL Bypass T1218 System Binary Proxy Execution User privileges
dotnet.exe will execute any DLL even if applocker is enabled.
dotnet.exe {PATH:.dll}Trips 1 Sigma rule: mediumArbitrary DLL or Csproj Code Execution Via Dotnet.EXE by Beyu Denis, oscd.community
Execute T1218 System Binary Proxy Execution User privileges
dotnet.exe will execute any DLL.
dotnet.exe {PATH:.dll}Trips 1 Sigma rule: mediumArbitrary DLL or Csproj Code Execution Via Dotnet.EXE by Beyu Denis, oscd.community
Execute T1059 Command and Scripting Interpreter User privileges
dotnet.exe will open a console which allows for the execution of arbitrary F# commands
dotnet.exe fsiTrips no Sigma process-creation rule.
AWL Bypass T1218 System Binary Proxy Execution User privileges
dotnet.exe with msbuild (SDK Version) will execute unsigned code
dotnet.exe msbuild {PATH:.csproj}Trips 1 Sigma rule: mediumArbitrary DLL or Csproj Code Execution Via Dotnet.EXE by Beyu Denis, oscd.community
3 of the 4 commands the identifier reads trip a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for dotnet.exe, by felamos, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for dotnet.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real dotnet.exe?
.NET Host in the file’s header: a renamed copy still carries itC:\Program Files (x86)\dotnet\C:\Program Files\dotnet\2 known copies
5,0,1121,47308 @Commit: f431858f8b1f1510723ace6343786c9194dbd7fc · C:\Program Files\dotnet\dotnet.exe · signed by Microsoft Corporation
0bbb5e1fa31ac3abb683248029253473208164b6316690b7cf49d509984133155,0,1121,47308 @Commit: f431858f8b1f1510723ace6343786c9194dbd7fc · C:\Program Files (x86)\dotnet\dotnet.exe · signed by Microsoft Corporation
fc799367f5ddb02755d3938c92a56262474fd9ca65ba53e5efdd5021a2584debFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.