Potential Application Whitelisting Bypass via Dnx.EXE

Title: Potential Application Whitelisting Bypass via Dnx.EXE
Status: test
Description:Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code. Attackers might abuse this in order to bypass application whitelisting.
References:
  -https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/
  -https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/
Author: Beyu Denis, oscd.community
Date: 2019-10-26
modified:2024-04-24
Tags:

• -'attack.stealth'
• -'attack.t1218'
• -'attack.t1027.004'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\dnx.exe'
  condition:selection
Falsepositives:
  -Legitimate use of dnx.exe by legitimate user
Level: medium