Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE

SigmaHQ Detections@sigmaHQ

•updated Oct 16, 2025•0•12

Detects the execution of arbitrary DLLs or unsigned code via '.csproj' files using the 'dotnet.exe' utility. This technique can be used for defense evasion and proxy execution.