{
  "family": "dotnet",
  "sample_count": 6,
  "category": "ransomware",
  "description": "Trojan:MSIL/Dotnet (or Generic.DotNet) is a broad, generic heuristic detection utilized by antivirus engines to flag highly suspicious or demonstrably malicious executable files that have been compiled using the Microsoft .NET framework (C#, VB.NET, F#). Because .NET code compiles to Intermediate Language (MSIL) rather than native machine code, it is exceptionally easy for malware authors to write, obfuscate, and iterate upon. This generic detection acts as a catch-all for newly compiled, unpackaged .NET malware that does not yet have a specific family signature.<br><br><b>Understanding the Dotnet Heuristic</b><br>To an end-user, an alert for 'Dotnet' simply means a virus was blocked. For a SOC analyst, this detection indicates the presence of a custom-written tool or a heavily obfuscated variant of known .NET malware (like Agent Tesla, AsyncRAT, or QuasarRAT). Malware authors heavily favor .NET because the framework provides built-in libraries for cryptography, network communication, and system interaction, drastically reducing development time.<br><br><b>Execution and Evasion Mechanics</b><br>Malicious .NET assemblies are typically delivered via phishing campaigns, often masquerading as legitimate installers or document viewers (`T1566.001`). Because MSIL can be easily decompiled using tools like dnSpy or ILSpy, threat actors rely heavily on advanced obfuscators (like ConfuserEx, SmartAssembly, or custom packers) (`T1027`). These obfuscators mangle class names, encrypt strings, and implement control flow flattening to confuse heuristic engines and human analysts. Upon execution (`T1204.002`), the .NET malware often utilizes 'Process Hollowing' or 'Reflection' (`T1055`) to inject its unencrypted payload directly into the memory of a legitimate Windows process (like `RegAsm.exe` or `MSBuild.exe`), bypassing static disk analysis.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the specific payload hidden within the generic .NET dropper (it could be ransomware, an infostealer, or a RAT). Host-based IoCs include EDR alerts for `.exe` files executing from the `%Temp%` or `%AppData%` directories, particularly if they immediately spawn native Windows utilities like `RegAsm.exe` (a strong indicator of process injection).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1027",
    "T1566.001",
    "T1204.002",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information (Use of .NET Obfuscators)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Often injecting into RegAsm.exe)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the network immediately, as the generic nature of the detection means the exact capability of the malware is unknown.",
    "Use an enterprise EDR solution to trace the process execution tree to determine what the .NET assembly actually *did* (e.g., did it drop files, alter the registry, or open network connections?).",
    "Collect the malicious `.exe` and submit it to a sandbox (like Any.Run or Hybrid Analysis) for dynamic analysis to identify its true family and C2 infrastructure.",
    "Ensure the endpoint has the latest Microsoft .NET Framework security patches installed."
  ],
  "what_to_avoid": [
    "Do not assume the threat is minor just because the detection name is generic; 'Dotnet' detections frequently mask sophisticated InfoStealers and RATs.",
    "Avoid relying purely on static analysis; heavily obfuscated .NET malware must often be executed in a controlled sandbox to reveal its true payload."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}