Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Registry-Free Process Scope COR_PROFILER

Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR. (Citation: Microsoft Profiling Mar 2017) (Citation: Microsoft COR_PROFILER Feb 2013)

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
François HubautCreated Thu Dec 3023590215-4702-4a70-8805-8dc9e58314a2windows
Log Source
WindowsPowerShell Script
ProductWindows← raw: windows
CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic
Detection Logic1 selector
detection:
    selection:
        ScriptBlockText|contains|all:
            - '$env:COR_ENABLE_PROFILING'
            - '$env:COR_PROFILER'
            - '$env:COR_PROFILER_PATH'
    condition: selection
False Positives

Legitimate administrative script

References
1
Resolving title…
github.com
MITRE ATT&CK
Rule Metadata
Rule ID
23590215-4702-4a70-8805-8dc9e58314a2
Status
test
Level
medium
Type
Detection
Created
Thu Dec 30
Author
François Hubaut
Path
rules/windows/powershell/powershell_script/posh_ps_cor_profiler.yml
Raw Tags
attack.privilege-escalationattack.defense-evasionattack.persistenceattack.t1574.012
View on GitHub