T1574.014 — AppDomainManager

Tactics: Stealth, Execution · Platforms: Windows

Adversaries may execute their own malicious payloads by hijacking how the .NET `AppDomainManager` loads assemblies. The .NET framework uses the `AppDomainManager` class to create and manage one or more isolated runtime environments (called application domains) inside a process to host the…

Sub-technique of Hijack Execution Flow (T1574).

Sigma detection rules (1)

T1574.014 Hijack Execution Flow: AppDomainManager

title: "T1574.014 Hijack Execution Flow: AppDomainManager"
id: ea5d1229-f50e-445d-9148-7bde1cf271b0
description: 'Detection strategy for Hijack Execution Flow via .NET AppDomainManager assembly hijacking, matched via process-creation command-line evidence of env-var or config-file assembly overrides. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TargetProcesses, AssemblyWhitelist, ConfigFilePaths, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1574/014
author: Shahrukh Khan
date: 2026-06-17
license: MIT
tags:
  - attack.stealth
  - attack.execution
  - attack.t1574.014

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_env_assignment:
    EventID: '1'
    CommandLine|contains:
      - 'APPDOMAIN_MANAGER_ASM='
      - 'APPDOMAIN_MANAGER_TYPE='
      - 'COMPLUS_APPDOMAIN_MANAGER_ASM='
      - 'COMPLUS_APPDOMAIN_MANAGER_TYPE='
  selection_config_reference:
    EventID: '1'
    CommandLine|contains:
      - 'appDomainManagerAssembly'
      - 'appDomainManagerType'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: (selection_env_assignment or selection_config_reference) and not filter_system_account

falsepositives:
  - Rare legitimate .NET hosting scenarios.

level: medium

Related sub-techniques

Explore