Full Report
Uncover how attackers use App Domain Manager injection to run code inside trusted .NET apps by tweaking config files and bypassing application controls. Learn key strategies to detect and stop these attacks.
Analysis Summary
# Tool/Technique: App Domain Manager Injection
## Overview
App Domain Manager injection is a technique that leverages a legitimate feature of the .NET Framework to execute arbitrary code within the context of a trusted, often Microsoft-signed, application. By manipulating how the Common Language Runtime (CLR) initializes an application domain, attackers can force a legitimate program to load a malicious assembly (DLL) before the application’s primary logic begins. This allows for stealthy execution, persistence, and defense evasion.
## Technical Details
- **Type:** Technique (Sub-category of Living off the Land / DLL Sideloading)
- **Platform:** Windows (.NET Framework applications)
- **Capabilities:**
- Execution within trusted process memory.
- Application Control/Allowlisting bypass.
- Remote code execution (via UNC/HTTP paths in config).
- Environment variable-based persistence.
- **First Seen:** Publicly discussed as a research topic circa 2017 (DerbyCon); highlighted in recent threat hunts (2025/2026 context).
## MITRE ATT&CK Mapping
- **[TA0002 - Execution]**
- [T1574.014 - Hijack Execution Flow: AppDomainManager Injection]
- **[TA0005 - Defense Evasion]**
- [T1218 - System Binary Proxy Execution]
- [T1553.002 - Subvert Trust Controls: Code Signing]
- **[TA0003 - Persistence]**
- [T1574 - Hijack Execution Flow]
## Functionality
### Core Capabilities
- **Config File Manipulation:** Placing a crafted `.exe.config` file alongside a legitimate .NET executable. The config specifies a custom `appDomainManagerType` and `appDomainManagerAssembly`.
- **Initialization Hijacking:** The CLR reads the config and loads the specified malicious assembly into the process space during the very first stage of application startup.
- **Context Masquerading:** The malicious code inherits the permissions, digital signature trust, and process name of the host application (e.g., `powershell.exe`, `mscorsvw.exe`).
### Advanced Features
- **Remote Assembly Loading:** The configuration can point to a remote location (e.g., `\\attacker-server\share\malicious.dll` or an HTTP URL). The .NET runtime handles the download and execution automatically.
- **Environment Variable Injection:** Instead of a physical file, attackers can set `COMPlus_AppDomainManagerType` and `COMPlus_AppDomainManagerAssembly` environment variables. Any .NET application launched in that session will subsequently load the malicious assembly.
## Indicators of Compromise
- **File Names:**
- `[TargetAppName].exe.config` (e.g., `Notepad++.exe.config` or `calc.exe.config`) found in unusual writable directories.
- **Registry Keys:**
- `HKCU\Environment` or `HKLM\System\CurrentControlSet\Control\Session Manager\Environment` containing `COMPlus_` prefixed variables.
- **Network Indicators:**
- Outbound connections from unexpected .NET binaries to remote SMB/UNC shares or web servers (`http[s]://[defanged-ip]/[path]/[file].dll`).
- **Behavioral Indicators:**
- A Microsoft-signed binary loading an unsigned or metadata-mismatched DLL from a non-standard path (e.g., `C:\Users\Public\`).
- The `mscoree.dll` or `clr.dll` modules loading assemblies from network paths.
## Associated Threat Actors
- **General LoTL (Living off the Land) practitioners:** Used by various sophisticated actors to bypass EDR and Application Allowlisting (AWL).
- **Access Brokers:** Often used as a secondary stage to maintain persistence after initial access via vulnerabilities like CVE-2025-26399.
## Detection Methods
- **Signature-based detection:** Scanning for XML configuration files containing the `appDomainManagerType` and `appDomainManagerAssembly` tags.
- **Behavioral detection:**
- Monitoring for the creation of `.config` files in directories where they do not usually exist.
- EDR telemetry looking for `.NET` processes where the `AppDomain` is modified via environment variables.
- **YARA Rules:** Target the XML structure of .NET config files that define custom App Domain Managers outside of known-good developer environments.
## Mitigation Strategies
- **Application Control:** Use Windows Defender Application Control (WDAC) or AppLocker in "Constrained Language Mode" for .NET.
- **Hardening:** Restrict write permissions to application directories to prevent the placement of malicious `.config` files.
- **Environment Monitoring:** Regularly audit and alert on the creation of `COMPlus_` environment variables.
- **Managed ESPM:** Utilize Endpoint Security Policy Management to ensure consistent hardening across all workstations.
## Related Tools/Techniques
- **DLL Sideloading:** Similar in goal, but App Domain Manager injection uses built-in .NET logic rather than search order hijacking.
- **Reflective DLL Injection:** Both aim to run code in memory, but App Domain Manager injection is "built-in" to the OS framework.
- **GhostWriter:** A known tool/technique for manipulating .NET assembly loading.