Full Report
Uncover how attackers use App Domain Manager injection to run code inside trusted .NET apps by tweaking config files and bypassing application controls. Learn key strategies to detect and stop these attacks.
Analysis Summary
# Tool/Technique: App Domain Manager Injection
## Overview
App Domain Manager injection is a technique that leverages a legitimate feature of the Microsoft .NET Framework to execute arbitrary code within the context of a trusted, often digitally signed, .NET application. By manipulating how the Common Language Runtime (CLR) initializes an application domain, attackers can force a program to load a malicious assembly (DLL) before the legitimate application logic begins, effectively hijacking the process for stealthy execution, persistence, or lateral movement.
## Technical Details
- **Type**: Technique (Living-off-the-Land / Subversion of Trust)
- **Platform**: Windows (.NET Framework)
- **Capabilities**: Bypasses application whitelisting (AppLocker/WDAC), executes code in memory, supports remote assembly loading (UNC/HTTP), and masks malicious activity under trusted process names.
- **First Seen**: Historically documented by researchers like Casey Smith; highlighted in active exploitation contexts as of early 2025/2026.
## MITRE ATT&CK Mapping
- **TA0002 - Execution**
- **T1059.005** - Command and Scripting Interpreter: .NET Management
- **TA0005 - Defense Evasion**
- **T1574.014** - Hijack Execution Flow: AppDomainManager Injection
- **T1218** - System Binary Proxy Execution
- **TA0003 - Persistence**
- **T1574** - Hijack Execution Flow
## Functionality
### Core Capabilities
- **Configuration File Manipulation**: Attackers place a `.config` file (e.g., `appname.exe.config`) in the same directory as a trusted .NET executable. This file specifies a custom `appDomainManagerType` and `appDomainManagerAssembly`.
- **Environment Variable Overrides**: Attackers can trigger the injection globally or for specific processes by setting environment variables:
- `COMPlus_AppDomainManagerType`
- `COMPlus_AppDomainManagerAssembly`
- **Trust Exploitation**: Malicious code inherits the trust level and process name of the host binary (e.g., a signed Microsoft utility), making it invisible to basic EDR process-tree monitoring.
### Advanced Features
- **Remote Assembly Loading**: The technique supports loading malicious assemblies from remote locations via UNC paths or HTTP/HTTPS, avoiding the need to drop the malicious DLL on the local disk.
- **Initialization Hijacking**: Because the code runs during the AppDomain initialization phase, it can execute even before the main entry point of the legitimate application is reached.
## Indicators of Compromise
- **File Names**:
- Look for unusual `.exe.config` files in directories containing standard Windows or third-party .NET binaries.
- Unexpected DLLs appearing in application folders that do not match the original software manifest.
- **Behavioral Indicators**:
- A trusted .NET process (e.g., `powershell.exe`, `mscorsvw.exe`) making unexpected outbound network connections (especially over SMB or HTTP to external IPs).
- Presence of the `COMPlus_AppDomainManagerType` environment variable in process memory or registry keys.
- A process loading an assembly from a `Temp` directory or a remote network share.
## Associated Threat Actors
- **General Adoption**: Used widely by sophisticated actors (APTs) and Red Teams for defense evasion.
- **Specific Mentions**: Often linked to campaigns involving "Living off the Land" (LotL) tactics to bypass Managed EDR and App Control environments.
## Detection Methods
- **Behavioral Detection**:
- Monitor for the creation or modification of `.config` files in protected or unusual directories (e.g., `C:\Windows\Microsoft.NET\`).
- Audit process start events for the presence of `COMPlus_` environment variables.
- Track "Module Load" events where a signed binary loads an unsigned or unusually named DLL.
- **Signature-based Detection**:
- Scan `.config` files for the strings `appDomainManagerType` and `appDomainManagerAssembly` where they are not expected.
## Mitigation Strategies
- **Application Control**: Implement robust application whitelisting (Windows Defender Application Control - WDAC) that enforces signature validation for both executables and their associated configuration files.
- **Hardening**: Restrict write permissions to application directories to prevent attackers from dropping `.config` files.
- **Monitoring**: Use EDR tools to alert on "Module Loads" from remote paths (UNC/WebDAV).
- **Managed ESPM**: Utilize Endpoint Security Posture Management to identify and close misconfigurations in the .NET runtime environment.
## Related Tools/Techniques
- **DLL Side-Loading**: Similar in that it uses legitimate search orders, but App Domain Manager injection is specific to the .NET CLR initialization logic.
- **Reflective DLL Injection**: Used for in-memory execution, whereas App Domain Manager injection relies on the legitimate .NET loader.
- **GhostWriter**: A tool/technique often used to automate the generation of malicious AppDomain managers.