T1574.012 — COR_PROFILER

Tactics: Stealth, Execution · Platforms: Windows

Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that…

Sub-technique of Hijack Execution Flow (T1574).

Sigma detection rules (1)

T1574.012 Hijack Execution Flow: COR_PROFILER

title: "T1574.012 Hijack Execution Flow: COR_PROFILER"
id: f781f383-d86e-4fe3-8aaf-afc26b01f8d9
description: 'Detection Strategy for Hijack Execution Flow using the Windows COR_PROFILER.. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: AllowedProfilers, ProcessScope, TimeWindow, ProfilerDllPaths.'
references:
  - https://attack.mitre.org/techniques/T1574/012
author: Shahrukh Khan
date: 2026-02-22
license: MIT
tags:
  - attack.stealth
  - attack.execution
  - attack.t1574.012

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    CommandLine|contains:
      - 'COR_ENABLE_PROFILING'
      - 'COR_PROFILER'

  condition: selection

falsepositives:
  - Legitimate .NET profiling/APM tooling (e.g. New Relic, AppDynamics) sets these same environment variables — allowlist known APM agent paths.

level: high

Related sub-techniques

Explore