T1574.012 COR_PROFILER — Attack Simulation

Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profilers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR. The…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Registry-free process scope COR_PROFILER
windows automated powershell
Procedure 79d57242-bbef-41db-b301-9d01d9f6e817; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
User scope COR_PROFILER
windows automated powershell
Procedure 9d5f89dc-c3a5-4f8a-a4fc-a6ed02e7cb5a; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
System Scope COR_PROFILER
windows automated powershell
Procedure f373b482-48c8-4ce4-85ed-d40c8b3f7310; elevation required; cleanup present, not reviewed. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Windows execution stealth isolated_authorized_lab procedure_review_required telemetry_configuration_required some_candidates_require_elevation

can_simulate subtechnique source_mapped

Detection and collection

T1574.012 detection workspace

Attack tools

No reviewed association in this snapshot.

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Blue Mockingbird · G0108

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.