Detectionmediumtest

Binary Proxy Execution Via Dotnet-Trace.EXE

Detects commandline arguments for executing a child process via dotnet-trace.exe

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Jimmy BayneCreated Tue Jan 029257c05b-4a4a-48e5-a670-b7b073cf401bwindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|endswith: '\dotnet-trace.exe'
        - OriginalFileName: 'dotnet-trace.dll'
    selection_cli:
        CommandLine|contains|all:
            - '-- '
            - 'collect'
    condition: all of selection_*