COR_PROFILER (T1574.012) is a Windows technique in the stealth and execution tactics. The adversary abuses the COR_PROFILER environment variable to hijack programs that load the .NET Common Language Runtime (CLR).
How attackers use it
COR_PROFILER is a .NET Framework feature that lets developers name an unmanaged profiling DLL to be loaded into each .NET process that starts the CLR. The feature exists for monitoring, troubleshooting and debugging managed code.
The variable can be set at system, user or process scope. System and user scope settings live in the Registry, where a COM object can be registered as a profiler DLL. A process-scope setting can be made in memory without touching the Registry. Since .NET Framework 4, the DLL does not need to be registered if its location is given in the COR_PROFILER_PATH variable.
MITRE says adversaries can use it for persistence, because the malicious DLL runs in every .NET process each time the CLR is invoked. It can also raise privileges (for example to bypass User Account Control) if a victim .NET process runs at a higher level, and it can be used to hook and impair defenses provided by .NET processes.
How to detect it
MITRE's analytic watches for changes to COR_ENABLE_PROFILING, COR_PROFILER and COR_PROFILER_PATH in the environment or Registry, combined with unusual .NET process creation or unmanaged DLL loads. Look for Registry modifications, process starts with altered environment variables, and profiler DLLs loading unexpectedly into CLR processes.
How to reduce the risk
- Restrict Registry permissions. Set permissions on Registry hives so users cannot change the keys tied to COR_PROFILER.
- Execution prevention. Use application control such as AppLocker to audit or block unapproved DLLs, including unmanaged profiler DLLs.
- User account management. Limit account privileges so only authorized administrators can edit system environment variables.
Check your own environment
# Windows PowerShell: any COR_ variables visible in this session
Get-ChildItem Env: | Where-Object Name -like 'COR_*'
# Windows cmd: machine-wide and user-wide environment values
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v COR_PROFILER
reg query HKCU\Environment /v COR_PROFILER
If a query reports the value is not found, that is the normal result. If you do not run a profiler product, any value is worth a look.
Quick check
Why is COR_PROFILER good persistence for an attacker?
The profiler DLL loads into every .NET process that starts the CLR, so the code runs repeatedly without a separate startup entry.
