dotnet.exe comes with .NET Framework
dotnet.exe [PATH_TO_DLL]
dotnet.exe will execute any dll even if applocker is enabled.
Execute code bypassing AWL
C:\Program Files\dotnet\dotnet.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_dotnet.yml, BlockRule: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules, IOC: dotnet.exe spawned an unknown process
felamos (@_felamos), Jimmy (@bohops), yamalon (@mavinject)