Enabling COR Profiler Environment Variables

Title: Enabling COR Profiler Environment Variables
Status: test
Description:Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.
References:
  -https://twitter.com/jamieantisocial/status/1304520651248668673
  -https://www.slideshare.net/JamieWilliams130/started-from-the-bottom-exploiting-data-sources-to-uncover-attck-behaviors
  -https://www.sans.org/cyber-security-summit/archives
  -https://learn.microsoft.com/en-us/dotnet/core/runtime-config/debugging-profiling
Author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research), Jimmy Bayne (@bohops)
Date: 2020-09-10
modified:2023-11-24
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.012'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection_1:
    TargetObject|endswith:
      -'\COR_ENABLE_PROFILING'
      -'\COR_PROFILER'
      -'\CORECLR_ENABLE_PROFILING'

  selection_2:
    TargetObject|contains: '\CORECLR_PROFILER_PATH'
  condition:1 of selection_*
Falsepositives:
Level: medium