File Operation via .NET Class

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the use of dotnet method in command lines which could be used for unauthorized file operations such as copying files. It could indicate suspicious activity because there are many normal ways to copy files in Windows, thus adversary may use this rarely used method to avoid detection.

Internal Research

2026-02-06 00:00:00

None

6b9e0d40-8b3a-41e4-a3a3-5872a9232cd9

attack.defense-evasion

Nextron Sigma feed only (private)