Dotnet.exe

dotnet.exe comes with .NET Framework

AWL Bypass

Execute code bypassing AWL

dotnet.exe {PATH:.dll}

dotnet.exe will execute any DLL even if applocker is enabled. — MITRE: T1218 — Privileges: User

Execute code bypassing AWL

dotnet.exe msbuild {PATH:.csproj}

dotnet.exe with msbuild (SDK Version) will execute unsigned code — MITRE: T1218 — Privileges: User

Execute

Execute DLL

dotnet.exe {PATH:.dll}

dotnet.exe will execute any DLL. — MITRE: T1218 — Privileges: User

Execute arbitrary F# code

dotnet.exe fsi

dotnet.exe will open a console which allows for the execution of arbitrary F# commands — MITRE: T1059 — Privileges: User