Binary Proxy Execution Via Dotnet-Trace.EXE
Detects the execution of 'dotnet-trace.exe' with command-line arguments indicative of proxy execution, specifically when it's used to collect traces for another process. This technique can be abused by adversaries to bypass defenses by leveraging a trusted Microsoft-signed binary to execute malicious code or actions.
Sigma
