Enabling COR Profiler Environment Variables

Hunt Hypothesis

Detects .NET Framework CLR and .NET Core CLR “cor_enable_profiling” and “cor_profiler” variables being set and configured.

Detection Rule

Sigma (Original)

title: Enabling COR Profiler Environment Variables
id: ad89044a-8f49-4673-9a55-cbd88a1b374f
status: test
description: Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.
references:
    - https://twitter.com/jamieantisocial/status/1304520651248668673
    - https://www.slideshare.net/JamieWilliams130/started-from-the-bottom-exploiting-data-sources-to-uncover-attck-behaviors
    - https://www.sans.org/cyber-security-summit/archives
    - https://learn.microsoft.com/en-us/dotnet/core/runtime-config/debugging-profiling
author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research), Jimmy Bayne (@bohops)
date: 2020-09-10
modified: 2023-11-24
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.012
logsource:
    category: registry_set
    product: windows
detection:
    selection_1:
        TargetObject|endswith:
            - '\COR_ENABLE_PROFILING'
            - '\COR_PROFILER'
            - '\CORECLR_ENABLE_PROFILING'
    selection_2:
        TargetObject|contains: '\CORECLR_PROFILER_PATH'
    condition: 1 of selection_*
level: medium

KQL (Azure Sentinel)

imRegistry
| where (RegistryKey endswith "\\COR_ENABLE_PROFILING" or RegistryKey endswith "\\COR_PROFILER" or RegistryKey endswith "\\CORECLR_ENABLE_PROFILING") or RegistryKey contains "\\CORECLR_PROFILER_PATH"

KQL (Microsoft 365 Defender)

DeviceRegistryEvents
| where (RegistryKey endswith "\\COR_ENABLE_PROFILING" or RegistryKey endswith "\\COR_PROFILER" or RegistryKey endswith "\\CORECLR_ENABLE_PROFILING") or RegistryKey contains "\\CORECLR_PROFILER_PATH"

Required Data Sources

False Positive Guidance

No known false positives documented.

MITRE ATT&CK Context

• Tactic: Persistence
• Tactic: Privilege Escalation
• Tactic: Execution
• Technique: T1574.012 — T1574.012

References

• https://twitter.com/jamieantisocial/status/1304520651248668673
• https://www.slideshare.net/JamieWilliams130/started-from-the-bottom-exploiting-data-sources-to-uncover-attck-behaviors
• https://www.sans.org/cyber-security-summit/archives
• https://learn.microsoft.com/en-us/dotnet/core/runtime-config/debugging-profiling
• SigmaHQ Rule