From 253c298440b4da81637a51db4dd596d1e667484a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Iv=C3=A1n=20Cabrera?= <103500562+ivancabrera02@users.noreply.github.com> Date: Thu, 27 Aug 2026 19:51:01 +0200 Subject: [PATCH 1/6] Add files via upload --- yml/OSBinaries/dotnet-trace.yml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 yml/OSBinaries/dotnet-trace.yml diff --git a/yml/OSBinaries/dotnet-trace.yml b/yml/OSBinaries/dotnet-trace.yml new file mode 100644 index 00000000..40390343 --- /dev/null +++ b/yml/OSBinaries/dotnet-trace.yml @@ -0,0 +1,30 @@ +--- +Name: dotnet-trace.exe +Description: .NET diagnostic tool for collecting and analyzing ETW (Event Tracing for Windows) traces from running .NET applications. +Aliases: + - dotnet trace +Author: Iván Cabrera +Created: 2026-08-27 +Commands: + - Command: dotnet trace collect --duration 00:00:01 -- calc.exe + Description: Launches calc.exe and collects ETW trace data for 1 second during execution + Usecase: Trace child process execution, capture process creation events and system calls from launched applications for reconnaissance and analysis + Category: Execution + Privileges: User + MitreID: T1059 + OperatingSystem: Windows 10 All, Windows 11 All + Tags: + - ETW: ProcessTracing + - Capability: ProcessExecution +Full_Path: + - Path: C:\Program Files\dotnet\dotnet-trace.exe + - Path: C:\Program Files (x86)\dotnet\dotnet-trace.exe +Code_Sample: + - Code: https://github.com/dotnet/diagnostics/tree/main/src/Tools/dotnet-trace +Detection: + - IOC: Process creation with command line containing "dotnet trace collect" +Resources: + - Link: https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-trace + - Link: https://learn.microsoft.com/en-us/windows/win32/etw/about-event-tracing +Acknowledgement: + - Person: Iván Cabrera From e08f81f4921ffeee5832442c73d602e5e5ea1674 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Iv=C3=A1n=20Cabrera?= <103500562+ivancabrera02@users.noreply.github.com> Date: Thu, 27 Aug 2026 19:58:31 +0200 Subject: [PATCH 2/6] Add files via upload --- yml/OSBinaries/dotnet-counters.yml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 yml/OSBinaries/dotnet-counters.yml diff --git a/yml/OSBinaries/dotnet-counters.yml b/yml/OSBinaries/dotnet-counters.yml new file mode 100644 index 00000000..d24564f8 --- /dev/null +++ b/yml/OSBinaries/dotnet-counters.yml @@ -0,0 +1,30 @@ +--- +Name: dotnet-counters.exe +Description: .NET diagnostic tool for monitoring performance counters and runtime metrics of .NET applications in real-time. +Aliases: + - dotnet counters +Author: Iván Cabrera +Created: 2026-08-27 +Commands: + - Command: dotnet-counters.exe collect --duration 1 -- calc.exe + Description: Collect performance counter data for the process or command executed + Usecase: Trace child process execution, capture process creation events and system calls from launched applications for reconnaissance and analysis + Category: Execution + Privileges: User + MitreID: T1059 + OperatingSystem: Windows 10 All, Windows 11 All + Tags: + - ETW: ProcessTracing + - Capability: ProcessExecution +Full_Path: + - Path: C:\Program Files\dotnet\dotnet-counters.exe + - Path: C:\Program Files (x86)\dotnet\dotnet-counters.exe +Code_Sample: + - Code: https://github.com/dotnet/diagnostics/tree/main/src/Tools/dotnet-counters +Detection: + - IOC: Process creation with command line containing "dotnet counters" +Resources: + - Link: https://github.com/dotnet/diagnostics + - Link: https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-counters +Acknowledgement: + - Person: Iván Cabrera From 59468e8931b54cba2f8a2d017cf3842a47a2d930 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Iv=C3=A1n=20Cabrera?= <103500562+ivancabrera02@users.noreply.github.com> Date: Thu, 27 Aug 2026 20:07:51 +0200 Subject: [PATCH 3/6] Update dotnet-counters.yml --- yml/OSBinaries/dotnet-counters.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/yml/OSBinaries/dotnet-counters.yml b/yml/OSBinaries/dotnet-counters.yml index d24564f8..08eec1c3 100644 --- a/yml/OSBinaries/dotnet-counters.yml +++ b/yml/OSBinaries/dotnet-counters.yml @@ -9,7 +9,7 @@ Commands: - Command: dotnet-counters.exe collect --duration 1 -- calc.exe Description: Collect performance counter data for the process or command executed Usecase: Trace child process execution, capture process creation events and system calls from launched applications for reconnaissance and analysis - Category: Execution + Category: Execute Privileges: User MitreID: T1059 OperatingSystem: Windows 10 All, Windows 11 All From 5ff2020144200a853eabbbe47398263a40732523 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Iv=C3=A1n=20Cabrera?= <103500562+ivancabrera02@users.noreply.github.com> Date: Thu, 27 Aug 2026 20:09:23 +0200 Subject: [PATCH 4/6] Update dotnet-counters.yml --- yml/OSBinaries/dotnet-counters.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/yml/OSBinaries/dotnet-counters.yml b/yml/OSBinaries/dotnet-counters.yml index 08eec1c3..5dc02ca8 100644 --- a/yml/OSBinaries/dotnet-counters.yml +++ b/yml/OSBinaries/dotnet-counters.yml @@ -1,8 +1,6 @@ --- Name: dotnet-counters.exe Description: .NET diagnostic tool for monitoring performance counters and runtime metrics of .NET applications in real-time. -Aliases: - - dotnet counters Author: Iván Cabrera Created: 2026-08-27 Commands: From abdc60b3ad275b91591f241defa815aef6069171 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Iv=C3=A1n=20Cabrera?= <103500562+ivancabrera02@users.noreply.github.com> Date: Thu, 27 Aug 2026 20:09:34 +0200 Subject: [PATCH 5/6] Update dotnet-trace.yml --- yml/OSBinaries/dotnet-trace.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/yml/OSBinaries/dotnet-trace.yml b/yml/OSBinaries/dotnet-trace.yml index 40390343..0c4ec502 100644 --- a/yml/OSBinaries/dotnet-trace.yml +++ b/yml/OSBinaries/dotnet-trace.yml @@ -1,8 +1,6 @@ --- Name: dotnet-trace.exe Description: .NET diagnostic tool for collecting and analyzing ETW (Event Tracing for Windows) traces from running .NET applications. -Aliases: - - dotnet trace Author: Iván Cabrera Created: 2026-08-27 Commands: From 0929ca77cf6520d9fcf0e347c9109d2b04dc71b5 Mon Sep 17 00:00:00 2001 From: ivancabrera02 Date: Wed, 2 Sep 2026 22:27:12 +0200 Subject: [PATCH 6/6] Address review feedback: move to OtherMSBinaries, fix format Changes per reviewer request: - Move files from OSBinaries/ to OtherMSBinaries/ (not default Windows binaries) - Fix Category: Execution -> Execute (dotnet-trace.yml) - Fix Tags: remove custom labels, add Execute: EXE - Fix OperatingSystem format: Windows 10, Windows 11 - Replace calc.exe with {PATH:.exe} placeholder - Fix MitreID: T1059 -> T1127 on both entries - Fix Full_Path to correct install location (%USERPROFILE%\.dotnet\tools\) - Add Handle to Acknowledgement Co-Authored-By: Claude Opus 4.6 --- yml/OSBinaries/dotnet-counters.yml | 28 ------------------------- yml/OSBinaries/dotnet-trace.yml | 28 ------------------------- yml/OtherMSBinaries/dotnet-counters.yml | 27 ++++++++++++++++++++++++ yml/OtherMSBinaries/dotnet-trace.yml | 27 ++++++++++++++++++++++++ 4 files changed, 54 insertions(+), 56 deletions(-) delete mode 100644 yml/OSBinaries/dotnet-counters.yml delete mode 100644 yml/OSBinaries/dotnet-trace.yml create mode 100644 yml/OtherMSBinaries/dotnet-counters.yml create mode 100644 yml/OtherMSBinaries/dotnet-trace.yml diff --git a/yml/OSBinaries/dotnet-counters.yml b/yml/OSBinaries/dotnet-counters.yml deleted file mode 100644 index 5dc02ca8..00000000 --- a/yml/OSBinaries/dotnet-counters.yml +++ /dev/null @@ -1,28 +0,0 @@ ---- -Name: dotnet-counters.exe -Description: .NET diagnostic tool for monitoring performance counters and runtime metrics of .NET applications in real-time. -Author: Iván Cabrera -Created: 2026-08-27 -Commands: - - Command: dotnet-counters.exe collect --duration 1 -- calc.exe - Description: Collect performance counter data for the process or command executed - Usecase: Trace child process execution, capture process creation events and system calls from launched applications for reconnaissance and analysis - Category: Execute - Privileges: User - MitreID: T1059 - OperatingSystem: Windows 10 All, Windows 11 All - Tags: - - ETW: ProcessTracing - - Capability: ProcessExecution -Full_Path: - - Path: C:\Program Files\dotnet\dotnet-counters.exe - - Path: C:\Program Files (x86)\dotnet\dotnet-counters.exe -Code_Sample: - - Code: https://github.com/dotnet/diagnostics/tree/main/src/Tools/dotnet-counters -Detection: - - IOC: Process creation with command line containing "dotnet counters" -Resources: - - Link: https://github.com/dotnet/diagnostics - - Link: https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-counters -Acknowledgement: - - Person: Iván Cabrera diff --git a/yml/OSBinaries/dotnet-trace.yml b/yml/OSBinaries/dotnet-trace.yml deleted file mode 100644 index 0c4ec502..00000000 --- a/yml/OSBinaries/dotnet-trace.yml +++ /dev/null @@ -1,28 +0,0 @@ ---- -Name: dotnet-trace.exe -Description: .NET diagnostic tool for collecting and analyzing ETW (Event Tracing for Windows) traces from running .NET applications. -Author: Iván Cabrera -Created: 2026-08-27 -Commands: - - Command: dotnet trace collect --duration 00:00:01 -- calc.exe - Description: Launches calc.exe and collects ETW trace data for 1 second during execution - Usecase: Trace child process execution, capture process creation events and system calls from launched applications for reconnaissance and analysis - Category: Execution - Privileges: User - MitreID: T1059 - OperatingSystem: Windows 10 All, Windows 11 All - Tags: - - ETW: ProcessTracing - - Capability: ProcessExecution -Full_Path: - - Path: C:\Program Files\dotnet\dotnet-trace.exe - - Path: C:\Program Files (x86)\dotnet\dotnet-trace.exe -Code_Sample: - - Code: https://github.com/dotnet/diagnostics/tree/main/src/Tools/dotnet-trace -Detection: - - IOC: Process creation with command line containing "dotnet trace collect" -Resources: - - Link: https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-trace - - Link: https://learn.microsoft.com/en-us/windows/win32/etw/about-event-tracing -Acknowledgement: - - Person: Iván Cabrera diff --git a/yml/OtherMSBinaries/dotnet-counters.yml b/yml/OtherMSBinaries/dotnet-counters.yml new file mode 100644 index 00000000..e051baae --- /dev/null +++ b/yml/OtherMSBinaries/dotnet-counters.yml @@ -0,0 +1,27 @@ +--- +Name: dotnet-counters.exe +Description: .NET diagnostic tool for monitoring performance counters of .NET applications in real-time. Installed via 'dotnet tool install --global dotnet-counters' (.NET SDK required). +Author: Iván Cabrera +Created: 2026-08-27 +Commands: + - Command: dotnet-counters.exe collect --duration 1 -- {PATH:.exe} + Description: Launches the specified executable as a child process while collecting performance counter data for 1 second. + Usecase: Execute a child process under the guise of a legitimate .NET diagnostic tool. + Category: Execute + Privileges: User + MitreID: T1127 + OperatingSystem: Windows 10, Windows 11 + Tags: + - Execute: EXE +Full_Path: + - Path: C:\Users\\.dotnet\tools\dotnet-counters.exe +Code_Sample: + - Code: https://github.com/dotnet/diagnostics/tree/main/src/Tools/dotnet-counters +Detection: + - IOC: Process creation with command line containing "dotnet-counters collect" and "--" +Resources: + - Link: https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-counters + - Link: https://github.com/dotnet/diagnostics +Acknowledgement: + - Person: Iván Cabrera + Handle: '@ivancabrera02' diff --git a/yml/OtherMSBinaries/dotnet-trace.yml b/yml/OtherMSBinaries/dotnet-trace.yml new file mode 100644 index 00000000..a8dafd58 --- /dev/null +++ b/yml/OtherMSBinaries/dotnet-trace.yml @@ -0,0 +1,27 @@ +--- +Name: dotnet-trace.exe +Description: .NET diagnostic tool for collecting runtime traces from .NET applications. Installed via 'dotnet tool install --global dotnet-trace' (.NET SDK required). +Author: Iván Cabrera +Created: 2026-08-27 +Commands: + - Command: dotnet-trace.exe collect --duration 00:00:01 -- {PATH:.exe} + Description: Launches the specified executable as a child process while collecting runtime trace data for 1 second during execution. + Usecase: Execute a child process under the guise of a legitimate .NET diagnostic tool. + Category: Execute + Privileges: User + MitreID: T1127 + OperatingSystem: Windows 10, Windows 11 + Tags: + - Execute: EXE +Full_Path: + - Path: C:\Users\\.dotnet\tools\dotnet-trace.exe +Code_Sample: + - Code: https://github.com/dotnet/diagnostics/tree/main/src/Tools/dotnet-trace +Detection: + - IOC: Process creation with command line containing "dotnet-trace collect" and "--" +Resources: + - Link: https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-trace + - Link: https://github.com/dotnet/diagnostics +Acknowledgement: + - Person: Iván Cabrera + Handle: '@ivancabrera02'