Skip to content
Threat Feed
Subscribe
medium advisory

Persistence via COR Profiler Environment Variables

Attackers can achieve persistence or privilege escalation by configuring environment variables that force the .NET runtime to load a malicious profiler DLL into managed processes.

Triage facts

Revision 1
Evidence
Unknown
Severity
Medium
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 10, 03:08 UTC
Detection
1 rule
Source quality
A1Roughly even chance

The .NET runtime supports environment variables, specifically COR_PROFILER and CORECLR_PROFILER, to enable performance monitoring and debugging. Attackers can abuse these variables to load a malicious DLL (a COM-based profiler) into any managed process that reads the environment, enabling code execution within the context of that process. By setting these variables in the Windows Registry (e.g., in HKLM\System\CurrentControlSet\Control\Session Manager\Environment or user-specific hives), an attacker can achieve persistent execution.

Impact

Successful exploitation allows for arbitrary code execution in the context of any managed process (including high-integrity system services) that utilizes the .NET framework, facilitating privilege escalation and persistence.

Recommendation

Deploy the provided Sigma rule to monitor for registry modifications related to .NET profiler configuration. Identify legitimate usage of profilers in your environment to minimize false positives, as these are typically used by development and troubleshooting tooling.

Immediate actions

Deploy the provided Sigma rule to SIEM and set alerting threshold for non-developer workstations

Detection Engineering 48h

Threat Hunt

Audit current environment variables on critical servers for existing COR_PROFILER or CORECLR_PROFILER settings

T1574.012 high high confidence hunt now

Data: PowerShell Get-ChildItem Env:, Registry hive inspection

Mitigations

Implement endpoint security controls to restrict unauthorized modification of system-wide environment variable registry keys

medium_term IT Operations

T1574.012

Detection coverage 1

Detect COR Profiler Environment Variable Modification

medium

Detects the creation or modification of .NET Framework and .NET Core profiler registry keys, which can be used to load arbitrary DLLs into managed processes.

sigma tactics: execution, persistence, privilege-escalation techniques: T1574.012 sources: registry_set, windows

Detection queries are available on the platform. Get full rules →