Identifier / Programs / Linux and Unix

dotnet

Cross platform .NET tools for .NET Core. Some subcommands such as build have their own usage documentation. tldr-pages

GTFOBins file-read, shell 1 ATT&CK technique 2 documented commands

How dotnet is abused

documented by GTFOBins

file-read

fsi

shell T1059.004 Command and Scripting Interpreter: Unix Shell

fsi

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for dotnet.

2 documented commands

from GTFOBins, each read by the identifier

file-read unprivileged, with sudo

dotnet fsi
System.IO.File.ReadAllText("/path/to/input-file");;

Identify

shell unprivileged, with sudo

dotnet fsi
System.Diagnostics.Process.Start("/bin/sh").WaitForExit();;

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for dotnet. The identifier reads the line of each that runs dotnet.

What detects it

Sigma process creation rules

T1059.004Command and Scripting Interpreter: Unix Shell

Everyday use

from tldr-pages, CC BY 4.0

Initialize a new .NET project

dotnet new template_short_nameIdentify

Restore NuGet packages

dotnet restoreIdentify

Build and execute the .NET project in the current directory

dotnet runIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

dotnet

How dotnet is abused

2 documented commands

What detects it

Everyday use

Other programs abused for file-read